Kubernetes clusters should use a non-vulnerable Kubernetes version
Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities. Vulnerability CVE-2019-9946 has been patched in Kubernetes versions 1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+.
Upgrade your Kubernetes service cluster to a later Kubernetes version to protect against known vulnerabilities in your current Kubernetes version.
What this control checks
Kubernetes clusters must run a version that is not known to be vulnerable
Common pitfalls
The effect parameter only allows Audit or Disabled
The Azure Policy check has an effect parameter with allowed values Audit and Disabled. The default is Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version" (fb893a29-21bb-418c-a157-e99480ec364c); PowerPipe control azure_compliance.control.kubernetes_cluster_upgraded_with_non_vulnerable_version.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SI-2 (Flaw Remediation) and SI-2(6) (Removal of Previous Versions of Software and Firmware).
FedRAMP Moderate Baseline Rev 4: Mapped to SI-2 (Flaw Remediation).
Framework mappings
The clauses this control is mapped to in each framework.
- SI-2 Flaw Remediation
- SI-2(6) Removal of Previous Versions of Software and Firmware
FedRAMP Moderate Baseline Rev 4
- SI-2 Flaw Remediation
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 1 IT Governance
- 3.3 Vulnerability Management
- SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner
- SI-2 Flaw Remediation
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_upgraded_with_non_vulnerable_version - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_upgraded_with_non_vulnerable_version - Azure Policy Definition:
fb893a29-21bb-418c-a157-e99480ec364c
Last reviewed: 2026-10-13