CVE-2019-4119: HTTP Proxy in IBM Cloud Private Kubernetes

The primary impact of CVE-2019-4119 is the ability for an attacker to leverage the Kubernetes API server as a proxy. This allows them to intercept and potentially modify traffic destined for internal cluster components or external services. An attacker could use this to exfiltrate sensitive data, perform man-in-the-middle attacks, or even gain access to systems outside the Kubernetes cluster. While the CVSS score is LOW, the potential for bypassing security controls and the broad scope of potential targets make this a significant concern, especially in environments with sensitive data or critical infrastructure.

1. Reserved2019-01-03
2. Published2019-05-17
3. Modified2024-09-16
4. EPSS updated2026-04-02

The recommended mitigation for CVE-2019-4119 is to upgrade to IBM Cloud Private Kubernetes version 3.1.3 or later, which includes the fix for this proxy misconfiguration. If an immediate upgrade is not feasible, consider implementing network segmentation to restrict access to the API server. Additionally, review and tighten API server access controls to limit who can interact with the API. Monitor API server logs for unusual traffic patterns that might indicate exploitation attempts. After upgrade, confirm the fix by verifying that external IP addresses are no longer accessible through the API server.