CLEANSTART-2026-WF93004: In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs

Q: Who is exposed to this issue?

Clusters using the nfs-subdir-external-provisioner package with Ceph RBD as the storage provisioner are exposed when the logging level is set to 4 or higher.

Q: What access would an attacker need to exploit the issue?

The supplied vector indicates local access, low privileges, and no user interaction are required. The disclosed impact is exposure of Ceph RBD admin secrets through logs.

Q: How can I determine whether my cluster may already be affected?

Check whether Ceph RBD is configured as the storage provisioner and whether the provisioner's logging level has been 4 or higher. Review logs generated under that configuration for Ceph RBD admin secrets.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2020-8566

Frequently Asked Questions

Who is exposed to this issue?

Clusters using the nfs-subdir-external-provisioner package with Ceph RBD as the storage provisioner are exposed when the logging level is set to 4 or higher.

What access would an attacker need to exploit the issue?

The supplied vector indicates local access, low privileges, and no user interaction are required. The disclosed impact is exposure of Ceph RBD admin secrets through logs.

How can I determine whether my cluster may already be affected?

Check whether Ceph RBD is configured as the storage provisioner and whether the provisioner's logging level has been 4 or higher. Review logs generated under that configuration for Ceph RBD admin secrets.

CLEANSTART-2026-WF93004: In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What access would an attacker need to exploit the issue?

How can I determine whether my cluster may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access would an attacker need to exploit the issue?

How can I determine whether my cluster may already be affected?