# CVE-2019-11250 remains in effect.

client-go's debuggingRoundTripper logs full curl commands including Authorization bearer tokens at high verbosity, letting log readers replay tokens to impersonate users.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): Patrick Rhomberg (purelyapplied)
- Found by: purelyapplied
- Disclosed: 2020-11-29
- CVE: CVE-2020-8565, CVE-2019-11250
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/952771
- Library page: https://bugbountylibrary.com/r/h1%3A952771
- Tags: area:cloud domain:cloud impact:ato kind:bounty platform:hackerone sev:medium tech:go tech:kubernetes technique:incomplete-fix technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** client-go transport debuggingRoundTripper (round_trippers.go)
**Root cause:** toCurl() builds a curl command embedding all request headers including Authorization, and the debugCurlCommand branch logs it without applying maskValue, unlike the debugRequestHeaders branch.
**Steps:**
1. Enable high verbosity logging: klog.V(9).Enabled()
2. Trigger a client request carrying an Authorization bearer token
3. Observe log line from `if rt.levels[debugCurlCommand] { klog.Infof("%s", reqInfo.toCurl()) }` at round_trippers.go:416
4. Extract the unmasked `-H "Authorization: Bearer <token>"` from the logged curl command
**How found:** Git archaeology tracing the toCurl code path; noticed the prior partial fix (PR #81330) only masked headers in the debugRequestHeaders block, leaving the preceding debugCurlCommand branch unmasked.
**Exploitation:** Attacker with read access to cluster/component logs greps for logged curl commands, extracts the bearer token, and replays it against the API server to masquerade as the victim user.
**Insight:** When a fix masks secrets in one logging branch, audit sibling branches that serialize the same request object (e.g. curl-command builders) for the same unmasked fields.