CVE-2026-123665 in kubescape
Summary
by MITRE • 11/06/2026
A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access. Upgrading to version 4.0.16 is recommended to address this issue. This patch is called d90f77314c7d4f2b53cf2425844bde2315bd26d2. Upgrading the affected component is advised.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in Kubescape versions up to 4.0.15 resides within the core/pkg/resultshandling/printer/printResults.go file, specifically affecting the GetWriter function of the Output component. This flaw allows for a manipulation of the outputFile argument which can lead to permission issues during execution. The issue stems from how the application handles file path inputs when attempting to write scan results or reports to disk. When an attacker with local access provides a crafted output file path, it may bypass expected directory restrictions or create files in unintended locations due to insufficient validation of the target destination's permissions and existence prior to writing operations. This represents a classic case where input handling logic fails to enforce strict constraints on resource creation paths, potentially leading to unauthorized file writes or denial of service through permission errors that disrupt normal operational workflows.
From a technical perspective, this vulnerability aligns with CWE-732, which describes incorrect permission assignment for critical resources. The root cause lies in the lack of rigorous checks ensuring that the specified output directory exists and is writable by the process user before attempting to open or create the file. In many Linux-based environments running container security tools like Kubescape, processes often run with specific service accounts that have limited privileges. If the code does not verify these permissions proactively, it may either fail silently, produce incomplete reports, or in worst-case scenarios where path traversal is possible due to poor sanitization, write files into sensitive system directories if the process has elevated rights elsewhere. Although the attack vector requires local access, which limits its exploitability by remote adversaries, it remains significant for threat actors who have already gained foothold on a node running Kubescape or can influence local script execution contexts.
The operational impact of this vulnerability is primarily centered around reliability and integrity of security reporting mechanisms. Since Kubescape is used to assess Kubernetes cluster configurations against best practices, any failure in generating accurate output files undermines the trustworthiness of the assessment results. Administrators relying on these reports for compliance auditing or remediation planning may receive incomplete data or encounter runtime errors that halt their automation pipelines. Furthermore, if permission issues result in failed writes to critical paths, it could trigger cascading failures in downstream tools that depend on parsing Kubescape's JSON or HTML outputs. This disrupts the continuous security monitoring loop essential for maintaining a secure Kubernetes environment.
Mitigation strategies focus primarily on software updates and operational hardening. The recommended course of action is to upgrade Kubescape to version 4.0.16 or later, where this issue has been addressed in patch d90f77314c7d4f2b53cf2425844bde2315bd26d2. This update likely includes enhanced validation logic for the outputFile parameter, ensuring that paths are sanitized and permissions are verified before file operations commence. In environments where immediate upgrading is not feasible, administrators should enforce strict input controls on any scripts or interfaces invoking Kubescape to prevent arbitrary path injection. Additionally, running the tool with least-privilege service accounts minimizes the potential impact of any successful exploitation by restricting write access to only necessary directories. Regularly auditing file system permissions and monitoring for unexpected file creations in sensitive locations can also help detect attempts to exploit this weakness before they cause significant disruption.