Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kubernetes/client-go
master @ d4060b1
24
Fixes
0
CVEs
HIGH
Peak severity
30.4%
Coverage
Highlights
Auth Bypass: 11 prior fixes. Scrutinize any change in this area.
plugin/pkg/client/auth/exec/exec.go: most-fixed (4 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Four separate fixes prevent the exec plugin from overriding static cert, basic auth, bearer token, or interactive terminal detection. The pattern is checking for pre-configured auth before applying exec auth; any new auth path (e.g., client-go plugins) may miss one of these guards.
Auth Bypass: GCP plugin had two auth bypass fixes: skip oauth2 transport when Authorization header is set, and clear cached credentials on 401. The header-presence check is a common guard that may be missing in other plugins or in custom transports.
Auth Bypass: OIDC plugin had two fixes: skip token injection when Authorization header set, and include cluster address in cache key to avoid wrong-token reuse. The cache-key issue is a variant of the token-cache staleness problem seen in transport/token_source.go.