Go Package Vulnerabilities

Open in search

Vulnerabilities associated with k8s.io/kubernetes.

Packages

Clear package

Showing 25 vulnerabilities on this page for k8s.io/kubernetes

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Portworx Half-Blind SSRF in kube-controller-manager

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

CWE-918Dec 14, 2025
CVSS5.8v3.1EPSS0.394%PoCs0SignalsSTIX

Nodes can delete themselves by adding an OwnerReference

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

CWE-863Aug 27, 2025
CVSS6.7v3.1EPSS0.543%PoCs0SignalsSTIX

Nodes can bypass dynamic resource allocation authorization checks

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

CWE-20CWE-863Jun 23, 2025
CVSS2.7v3.1EPSS0.663%PoCs0SignalsSTIX

Kubernetes GitRepo Volume Inadvertent Local Repository Access

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.

CWE-20Mar 13, 2025
CVSS6.5v3.1EPSS0.539%PoCs0SignalsSTIX

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

CWE-20CWE-77Mar 13, 2025
CVSS5.9v3.1EPSS1.4%PoCs0SignalsSTIX

Node Denial of Service via kubelet Checkpoint API

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

CWE-400Feb 13, 2025
CVSS6.2v3.1EPSS0.364%PoCs0SignalsSTIX

Arbitrary command execution through gitRepo volume

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

CWE-22Nov 22, 2024
CVSS-v4.0EPSS3%PoCs7SignalsSTIX

Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

CWE-20CWE-476Nov 17, 2024
CVSS7.7v3.1EPSS0.598%PoCs0SignalsSTIX

Incorrect permissions on Windows containers logs

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

CWE-276Jul 18, 2024
CVSS-v4.0EPSS0.312%PoCs0SignalsSTIX

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kube…

CWE-20Apr 22, 2024
CVSS2.7v3.1EPSS2.22%PoCs1SignalsSTIX

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

CWE-20Nov 14, 2023
CVSS7.2v3.1EPSS3.58%PoCs0SignalsSTIX

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CWE-20Oct 31, 2023
CVSS8.8v3.1EPSS3.39%PoCs0SignalsSTIX

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CWE-20Oct 31, 2023
CVSS8.8v3.1EPSS11.7%PoCs0SignalsSTIX

Windows kube-proxy LoadBalancer contention

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

CWE-114Oct 30, 2023
CVSS5.8v3.1EPSS0.915%PoCs0SignalsSTIX

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

CWE-20Jul 3, 2023
CVSS6.5v3.1EPSS2.16%PoCs1SignalsSTIX

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

CWE-20Jul 3, 2023
CVSS6.5v3.1EPSS1.13%PoCs0SignalsSTIX

Bypass of seccomp profile enforcement

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

CWE-1287Jun 16, 2023
CVSS3.4v3.1EPSS0.257%PoCs0SignalsSTIX

Bypass of Kubernetes API Server proxy TOCTOU

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation …

CWE-367Feb 1, 2022
CVSS2.2v3.1EPSS1.08%PoCs0SignalsSTIX

ANSI escape characters in kubectl output are not being filtered

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

CWE-150Jan 7, 2022
CVSS3.0v3.1EPSS0.778%PoCs0SignalsSTIX

Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

CWE-20CWE-552Sep 20, 2021
CVSS8.8v3.1EPSS7.96%PoCs3SignalsSTIX

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

CWE-441CWE-610Sep 20, 2021
CVSS3.1v3.1EPSS1.95%PoCs0SignalsSTIX

Webhook redirect in kube-apiserver

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

CWE-441CWE-610Sep 20, 2021
CVSS4.1v3.1EPSS2.1%PoCs0SignalsSTIX

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

CWE-184CWE-601Sep 6, 2021
CVSS2.7v3.1EPSS1.33%PoCs0SignalsSTIX

Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

CWE-284CWE-372CWE-863Sep 6, 2021
CVSS6.5v3.1EPSS5.52%PoCs1SignalsSTIX

Kubernetes man in the middle using LoadBalancer or ExternalIPs

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

CWE-283Jan 21, 2021
CVSS6.3v3.1EPSS9.27%PoCs6SignalsSTIX