CVE-2019-10165: OAuth Token Leak in OpenShift Container Platform

The primary impact of CVE-2019-10165 is unauthorized access to resources within the OpenShift Container Platform. An attacker who can access the audit logs—which may be accessible to administrators or through compromised accounts—can extract OAuth tokens. These tokens grant access to various Kubernetes and OpenShift API resources, potentially allowing the attacker to escalate privileges, read sensitive data, or even modify configurations. The blast radius is limited to the resources accessible through the compromised OAuth token, but the potential for damage is significant if the token grants broad permissions. This vulnerability shares similarities with other token leakage issues where improperly secured tokens can be exploited for unauthorized access.

1. Reserved2019-03-27
2. Published2019-07-30
3. Modified2024-08-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-10165 is to upgrade OpenShift Container Platform to version 4.1.3 or later, which includes the fix. If upgrading immediately is not possible, consider restricting access to the audit logs to only authorized personnel. Implement robust access controls and monitoring to detect any suspicious activity related to the audit logs. While not a direct fix, enabling audit log encryption can help protect the confidentiality of the tokens, although it does not prevent them from being logged in the first place. After upgrading, confirm the fix by verifying that OAuth tokens are no longer written in plaintext to the audit logs.