CLEANSTART-2026-HM58494: In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files

Q: Which deployments are exposed to token disclosure?

Deployments of cleanstart/nfs-subdir-external-provisioner are exposed when running in Kubernetes with the logging level set to 9 or higher. The provided data does not establish that lower logging levels are affected.

Q: What access does an attacker need to obtain the disclosed tokens?

The vulnerability writes authorization and bearer tokens to log files. Exploitation therefore requires access to those log files; the provided data does not specify the particular access path or permissions required.

Q: What can be done if patching is not immediately possible?

Reduce the Kubernetes logging level below 9 and restrict access to existing log files, since tokens may already have been recorded there. The provided data does not identify a fixed version or other remediation.

Q: How can I determine whether credentials may already have been exposed?

Check whether the provisioner has run with a logging level of 9 or above, then review the log files generated during that period for authorization or bearer tokens. Treat any tokens found in accessible logs as potentially exposed.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2020-8565

Frequently Asked Questions

Which deployments are exposed to token disclosure?

Deployments of cleanstart/nfs-subdir-external-provisioner are exposed when running in Kubernetes with the logging level set to 9 or higher. The provided data does not establish that lower logging levels are affected.

What access does an attacker need to obtain the disclosed tokens?

The vulnerability writes authorization and bearer tokens to log files. Exploitation therefore requires access to those log files; the provided data does not specify the particular access path or permissions required.

What can be done if patching is not immediately possible?

Reduce the Kubernetes logging level below 9 and restrict access to existing log files, since tokens may already have been recorded there. The provided data does not identify a fixed version or other remediation.

How can I determine whether credentials may already have been exposed?

Check whether the provisioner has run with a logging level of 9 or above, then review the log files generated during that period for authorization or bearer tokens. Treat any tokens found in accessible logs as potentially exposed.

CLEANSTART-2026-HM58494: In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to token disclosure?

What access does an attacker need to obtain the disclosed tokens?

What can be done if patching is not immediately possible?

How can I determine whether credentials may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to token disclosure?

What access does an attacker need to obtain the disclosed tokens?

What can be done if patching is not immediately possible?

How can I determine whether credentials may already have been exposed?