Skip to content
Fencer Intel
medium 6.3

CVE-2020-10706 json

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled.

published 6y ago modified 4mo ago also EUVD-2020-3136

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. This flaw allows an attacker with access to a backup to obtain OAuth tokens and then use them to log into the cluster as any user who logged into the cluster via the WebUI or via the command line in the last 24 hours. Once the backup is older than 24 hours the OAuth tokens are no longer valid.

Is CVE-2020-10706 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10706 updated cvss 6.3

openshift/openshift-apiserver: oauth tokens not encrypted when enabling encryption of data at rest

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: workaround, no fix planned “If you have made a vulnerable backup public you can revoke leaked OAuth tokens by deleting them with the OpenShift API.”
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-oauth-server-rhel8 v4.6.0-202010061132.p0
    fixed: vendor fix “If you have made a vulnerable backup public you can revoke leaked OAuth tokens by deleting them with the OpenShift API.” RHBA-2020:4196
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-pod v4.6.0-202010061132.p0, openshift4/ose-jenkins v4.6.0-202010120952.p0, openshift4/ose-deployer v4.6.0-202010080605.p0, openshift4/ose-sdn-rhel8 v4.6.0-202010061132.p0, openshift4/ose-telemeter v4.6.0-202010061132.p0, openshift4/ose-kube-proxy v4.6.0-202010061132.p0, +48 more
    not affected: vulnerable code not present “If you have made a vulnerable backup public you can revoke leaked OAuth tokens by deleting them with the OpenShift API.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.6 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • [UNKNOWN] openshift/openshift-apiserver

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.