Kubernetes Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with Kubernetes products.
Products
- Kubernetes51 vulnerabilities
- ingress-nginx17 vulnerabilities
- kubelet7 vulnerabilities
- Kubernetes ingress-nginx4 vulnerabilities
- Image Builder3 vulnerabilities
- minikube3 vulnerabilities
- image_builder2 vulnerabilities
- kube-apiserver2 vulnerabilities
- Kubernetes Java Client2 vulnerabilities
- Kubernetes Secrets Store CSI Driver2 vulnerabilities
- apiserver1 vulnerability
- argo-cd1 vulnerability
- aws-iam-authenticator1 vulnerability
- azure-file-csi-driver1 vulnerability
- CSI Driver for NFS1 vulnerability
- CSI Snapshotter1 vulnerability
- csi-proxy1 vulnerability
- devtron1 vulnerability
- k8s.gcr.io/defaultbackend1 vulnerability
- kops1 vulnerability
- Kubernetes CSharp Client1 vulnerability
- kubernetes-client/java1 vulnerability
- kubernetes-csi external-provisioner1 vulnerability
- kubernetes-csi external-resizer1 vulnerability
- kubernetes-csi external-snapshotter1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Path traversal via non-tar copyDirectoryFromPodA security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false. CWE-22Jul 23, 2026 | CVSS2.7v3.0 | EPSS0.235% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-3864MEDIUM | CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS serverA vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modificati… CWE-22Mar 20, 2026 | CVSS6.5v3.1 | EPSS0.539% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-4342HIGH | ingress-nginx comment-based nginx configuration injectionA security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CWE-20Mar 19, 2026 | CVSS8.8v3.1 | EPSS1.49% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-3288HIGH | ingress-nginx rewrite-target nginx configuration injectionA security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CWE-20Mar 9, 2026 | CVSS8.8v3.1 | EPSS6.3% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-15566HIGH | ingress-nginx auth-proxy-set-headers nginx configuration injectionA security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CWE-20Feb 6, 2026 | CVSS8.8v3.1 | EPSS0.469% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-24514MEDIUM | ingress-nginx Admission Controller denial of serviceA security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory. CWE-770Feb 3, 2026 | CVSS6.5v3.1 | EPSS0.46% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
ingress-nginx auth-url protection bypassA security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration. If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when auth… CWE-754Feb 3, 2026 | CVSS3.1v3.1 | EPSS0.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-24512HIGH | ingress-nginx auth-method nginx configuration injectionA security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CWE-20Feb 3, 2026 | CVSS8.8v3.1 | EPSS0.501% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-1580HIGH | ingress-nginx auth-method nginx configuration injectionA security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) CWE-20Feb 3, 2026 | CVSS8.8v3.1 | EPSS0.485% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13281MEDIUM | Portworx Half-Blind SSRF in kube-controller-managerA half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services). CWE-918Dec 14, 2025 | CVSS5.8v3.1 | EPSS0.394% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9708MEDIUM | Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacksA vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation. CWE-295Sep 16, 2025 | CVSS6.8v3.1 | EPSS0.288% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-7445MEDIUM | Kubernetes secrets-store-sync-controller discloses service account tokens in logsKubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs. CWE-532Sep 5, 2025 | CVSS6.5v3.1 | EPSS0.192% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-5187MEDIUM | Nodes can delete themselves by adding an OwnerReferenceA vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. CWE-863Aug 27, 2025 | CVSS6.7v3.1 | EPSS0.543% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-7342HIGH | VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not overrideA security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and m… CWE-798Aug 17, 2025 | CVSS7.5v3.1 | EPSS0.349% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Nodes can bypass dynamic resource allocation authorization checksA vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. | CVSS2.7v3.1 | EPSS0.663% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-24514HIGH | ingress-nginx controller - configuration injection via unsanitized auth-url annotationA security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) | CVSS8.8v3.1 | EPSS32.5% | PoCs6 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-24513MEDIUM | ingress-nginx controller - auth secret file path traversal vulnerabilityA security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster. | CVSS4.8v3.1 | EPSS3.52% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-1098HIGH | ingress-nginx controller - configuration injection via unsanitized mirror annotationsA security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) | CVSS8.8v3.1 | EPSS83.4% | PoCs5 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-1097HIGH | ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationA security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) | CVSS8.8v3.1 | EPSS35.4% | PoCs5 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-1974CRITICAL | ingress-nginx admission controller RCE escalationA security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.) | CVSS9.8v3.1 | EPSS99.5% | PoCs30 | SignalsNot listed in CISA KEVNo known ransomware use2 Nuclei templates | STIX |
Network restriction bypass via race condition during namespace terminationA security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced… CWE-362Mar 20, 2025 | CVSS3.1v3.1 | EPSS0.301% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-1767MEDIUM | Kubernetes GitRepo Volume Inadvertent Local Repository AccessThis CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable. CWE-20Mar 13, 2025 | CVSS6.5v3.1 | EPSS0.539% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9042MEDIUM | Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query APIThis CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below. | CVSS5.9v3.1 | EPSS1.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0426MEDIUM | Node Denial of Service via kubelet Checkpoint APIA security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk. CWE-400Feb 13, 2025 | CVSS6.2v3.1 | EPSS0.364% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Arbitrary command execution through gitRepo volumeThe Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2. CWE-22Nov 22, 2024 | CVSS-v4.0 | EPSS3% | PoCs7 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |