CLEANSTART-2026-FB85377: In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secr...

Q: Which deployments are exposed to credential leakage?

Clusters using nfs-subdir-external-provisioner are exposed when Kubernetes logging is configured at level 4 or higher and a malformed Docker configuration file is processed. The leaked file may contain image pull secrets or other registry credentials.

Q: What must an attacker or triggering condition provide?

A malformed Docker configuration file must be processed by the affected Kubernetes environment. The available information does not state how such a file is supplied or whether an attacker needs particular permissions to cause it to be processed.

Q: How can I determine whether sensitive data may already have been exposed?

Review Kubernetes logs generated while logging was set to level 4 or higher, particularly around errors processing Docker configuration files. Check whether malformed Docker configuration files were processed and whether their contents, including registry credentials or pull secrets, were recorded in logs.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2020-8564

Frequently Asked Questions

Which deployments are exposed to credential leakage?

Clusters using nfs-subdir-external-provisioner are exposed when Kubernetes logging is configured at level 4 or higher and a malformed Docker configuration file is processed. The leaked file may contain image pull secrets or other registry credentials.

What must an attacker or triggering condition provide?

A malformed Docker configuration file must be processed by the affected Kubernetes environment. The available information does not state how such a file is supplied or whether an attacker needs particular permissions to cause it to be processed.

How can I determine whether sensitive data may already have been exposed?

Review Kubernetes logs generated while logging was set to level 4 or higher, particularly around errors processing Docker configuration files. Check whether malformed Docker configuration files were processed and whether their contents, including registry credentials or pull secrets, were recorded in logs.

CLEANSTART-2026-FB85377: In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secr...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to credential leakage?

What must an attacker or triggering condition provide?

How can I determine whether sensitive data may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to credential leakage?

What must an attacker or triggering condition provide?

How can I determine whether sensitive data may already have been exposed?