Description
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Scores
CVSS v3
4.1
EPSS
0.0019
EPSS Percentile
40.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Details
CWE
CWE-441
CWE-610
Status
published
Products (4)
k8s.io/kubernetes
0Go
kubernetes/kubernetes
1.20.11
kubernetes/kubernetes
1.21.5
kubernetes/kubernetes
1.22.2
Published
Sep 20, 2021
Tracked Since
Feb 18, 2026