Search for packages
| purl | pkg:deb/debian/kubernetes@1.32.3%2Bds-2?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-17m6-nd3p-dybh | Kubernetes Sensitive Information leak via Log File In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13. |
CVE-2020-8564
GHSA-8mjg-8c8g-6h85 |
| VCID-2cbk-c4k3-kyc8 | Privilege Escalation in Kubernetes The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise. |
CVE-2020-8559
GHSA-33c5-9fx5-fvjm |
| VCID-2ej9-nn86-7bet | Kubernetes kubectl cp Vulnerable to Symlink Attack The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree. |
CVE-2019-11251
GHSA-6qfg-8799-r575 |
| VCID-35gz-1zjh-2qan | Kubernetes DoS Vulnerability In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server. |
CVE-2019-1002100
GHSA-q4rr-64r9-fwgf |
| VCID-3m8h-88sb-f7hk | Privilege Escalation in Kubernetes In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection. |
CVE-2018-1002105
GHSA-579h-mv94-g4gp |
| VCID-3rmn-ytr3-6yet | Kubernetes privilege escalation vulnerability A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. |
CVE-2023-3676
GHSA-7fxm-f474-hf8w |
| VCID-42kp-8t9h-dfat | kubectl ANSI escape characters not filtered kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events. |
CVE-2021-25743
GHSA-f9jg-8p32-2f55 |
| VCID-4gu9-2w32-xfcu | kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services). |
CVE-2025-13281
GHSA-r6j8-c6r2-37rr |
| VCID-4jze-ndvq-nqhn | Kubernetes Privilege Escalation Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object. |
CVE-2017-1000056
GHSA-2jx2-76rc-2v7v |
| VCID-4qqj-251q-ykek | Confused Deputy in Kubernetes A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack. |
CVE-2021-25740
GHSA-vw47-mr44-3jf9 |
| VCID-57ar-astn-b7eu | Kubernetes Unsafe Cacheing In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by `--cache-dir` (defaulting to `$HOME/.kube/http-cache`), written with world-writeable permissions (`rw-rw-rw-`). If `--cache-dir` is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation. |
CVE-2019-11244
GHSA-2575-pghm-6qqx |
| VCID-68f5-9mbb-syf5 | kubernetes: Incorrect rule injection in CNI portmap plugin |
CVE-2019-9946
|
| VCID-6nk9-wkwg-ukeh | Information Exposure in Kubernetes Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name. |
CVE-2015-7528
GHSA-mqf3-28j7-3mj6 |
| VCID-7359-arkb-zkg6 | Kubernetes mountable secrets policy bypass Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. |
CVE-2023-2728
GHSA-cgcv-5272-97pr |
| VCID-7ddh-ksnz-nbhj | Kubernetes privilege escalation vulnerability A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. |
CVE-2023-3955
GHSA-q78c-gwqw-jcmc |
| VCID-7gye-25qm-n3ed | Files or Directories Accessible to External Parties in kubernetes A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. |
CVE-2021-25741
GHSA-f5f7-6478-qm6p |
| VCID-8mtx-nq5t-dqcg | Node Denial of Service via kubelet Checkpoint API A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk. |
CVE-2025-0426
GHSA-jgfp-53c3-624w |
| VCID-8y33-9aqr-fubd | Kubernetes vulnerable to validation bypass Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. |
CVE-2022-3294
GHSA-jh36-q97c-9928 |
| VCID-92ak-64hu-dbg1 | kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) |
CVE-2022-3172
|
| VCID-9498-37sr-xyet | kubernetes: /debug/pprof endpoint exposed on kubelet's healthz port |
CVE-2019-11248
|
| VCID-9s34-1nd8-f7ee | XML Entity Expansion and Improper Input Validation in Kubernetes API server Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility. ### Specific Go Packages Affected k8s.io/kubernetes/pkg/apiserver |
CVE-2019-11253
GHSA-pmqp-h87c-mr78 |
| VCID-cjth-qqvy-hqhk | Kubelet Incorrect Privilege Assignment In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit `runAsUser` attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified `mustRunAsNonRoot: true`, the kubelet will refuse to start the container as root. If the pod did not specify `mustRunAsNonRoot: true`, the kubelet will run the container as uid 0. |
CVE-2019-11245
GHSA-r76g-g87f-vw8f |
| VCID-csq4-589g-qfa4 | Kubernetes client-go vulnerable to Sensitive Information Leak via Log File In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2. |
CVE-2020-8565
GHSA-8cfg-vx93-jvxw |
| VCID-dpht-br2m-zqfs | Kubernetes arbitrary file overwrite In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files. |
CVE-2018-1002100
GHSA-2jq6-ffph-p4h8 |
| VCID-dxej-zg13-63ff | Kubernetes did not effectively clear service account credentials In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig() |
CVE-2019-11243
GHSA-gc2p-g4fg-29vh |
| VCID-dxhw-y156-2kfz | Kubernetes API Server DoS Via API Requests The Kubernetes API server component in Kubernetes versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests. |
CVE-2020-8552
GHSA-82hx-w2r5-c2wq |
| VCID-ea5d-jxkg-mbhn | Kubernetes vulnerable to path traversal Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. |
CVE-2022-3162
GHSA-2394-5535-8j88 |
| VCID-eztq-5cu5-7yfd | Kubernetes Arbitrary Command Injection In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. ### Specific Go Packages Affected k8s.io/kubernetes/pkg/util/mount |
CVE-2018-1002101
GHSA-wqwf-x5cj-rg56 |
| VCID-fbzn-vujj-pud5 | Excessive Platform Resource Consumption within a Loop in Kubernetes The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML. |
CVE-2019-11254
GHSA-wxc4-f4m6-wwqv |
| VCID-fmcb-kpgu-5fcg | Authorization bypass in Openshift Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed. |
CVE-2016-1906
GHSA-m3fm-h5jp-q79p |
| VCID-fpvm-f4py-mfbb | kubernetes: Volume security can be sidestepped with innocent emptyDir and subpath |
CVE-2017-1002101
|
| VCID-ftrr-y54a-s7a1 | Kubernetes kubelet arbitrary command execution The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2. |
CVE-2024-10220
GHSA-27wf-5967-98gx |
| VCID-humx-y4h8-pbeb | kubernetes: Incomplete fix for CVE-2019-1002101 allows for arbitrary file write via `kubectl cp` |
CVE-2019-11246
|
| VCID-jgn7-651b-p3cm | Access Restriction Bypass in kube-apiserver A vulnerability in Kubernetes `kube-apiserver` could allow node updates to bypass a _Validating Admission Webhook_ and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission controller to accept requests that should be blocked. The vulnerability can be exploited when an update action on node resources is performed and an admission controller is in place and configured to validate the action. Users are only affected by this vulnerability if they are running a _Validating Admission Webhook_ for Nodes that denies admission based partially on the old state of the Node object. It only impacts validating admission plugins that rely on old values in certain fields and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin. |
CVE-2021-25735
GHSA-g42g-737j-qx6j |
| VCID-jjnq-w1uh-dudy | Incomplete List of Disallowed Inputs in Kubernetes A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs. |
CVE-2021-25737
GHSA-mfv7-gq43-w965 |
| VCID-jm3q-n1be-3uc8 | Kubelet vulnerable to bypass of seccomp profile enforcement A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. |
CVE-2023-2431
GHSA-xc8m-28vv-4pjc |
| VCID-jwt2-1eqe-qyfq | kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events for AzureFile and CephFS volumes |
CVE-2019-11252
|
| VCID-k31a-cbd1-wkh5 | Access Restriction Bypass in kubernetes The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object. ### Specific Go Packages Affected github.com/kubernetes/kubernetes/pkg/apiserver |
CVE-2016-1905
GHSA-xx8c-m748-xr4j |
| VCID-kgvu-q3dc-8khe | Confused Deputy in Kubernetes A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs. |
CVE-2020-8561
GHSA-74j8-88mm-7496 |
| VCID-m3n6-yj6t-y7eq | kubernetes: Incorrect default access permissions for Persistent Volumes |
CVE-2017-1002100
|
| VCID-nush-2wsq-b3f5 | Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation Kubernetes is vulnerable to privilege escalation when a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy. |
CVE-2023-3893
GHSA-r6cc-7wj7-gfx2 |
| VCID-ny1b-eq77-fuhw | Server Side Request Forgery (SSRF) in Kubernetes The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services). |
CVE-2020-8555
GHSA-x6mj-w4jf-jmgw |
| VCID-pjvk-1xxm-87d8 | Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. |
CVE-2024-3177
GHSA-pxhw-596r-rwq5 |
| VCID-ppcs-yxcf-57at | Kubernetes kube-apiserver Vulnerable to Race Condition A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced. |
CVE-2024-7598
GHSA-r56h-j38w-hrqq |
| VCID-pqb1-j3ad-efam | kube-apiserver vulnerable to policy bypass Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. |
CVE-2023-2727
GHSA-qc2g-gmh6-95p4 |
| VCID-ptve-3k7k-cqcm | Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250. |
CVE-2020-8551
GHSA-qhm4-jxv7-j9pq |
| VCID-qpg5-h1k8-yydt | Directory Traversal in Kubernetes Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd. |
CVE-2015-5305
GHSA-jp32-vmm6-3vf5 |
| VCID-qxw4-2hry-uuf4 | Kubernetes Improper Input Validation vulnerability A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. |
CVE-2023-5528
GHSA-hq6q-c2x6-hmch |
| VCID-rwt5-ctc9-tba1 | Kubernetes client-go library logs may disclose credentials to unauthorized users The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected. |
CVE-2019-11250
GHSA-jmrx-5g74-6v2f |
| VCID-srhm-91w1-k3h7 | kubelet: runAsNonRoot logic bypass for Windows containers |
CVE-2021-25749
|
| VCID-su6u-whda-fkdw | 3: API server does not validate client-provided intermediate certificates correctly |
CVE-2016-7075
|
| VCID-sur2-ewj3-8bgx | Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below. |
CVE-2024-9042
GHSA-vv39-3w5q-974q |
| VCID-tc46-9vdm-xudz | Improper Authentication in Kubernetes A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug. |
CVE-2020-8558
GHSA-wqv3-8cm6-h6wg |
| VCID-u8h6-kbws-8fbp | Sensitive Information leak via Log File in Kubernetes In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3. |
CVE-2020-8563
GHSA-5xfg-wv98-264m |
| VCID-uamg-zw29-yqgq | kubernetes allows nodes to bypass dynamic resource allocation authorization checks A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. |
CVE-2025-4563
GHSA-hj2p-8wj8-pfq4 |
| VCID-uge5-g4vw-n7de | Kubernetes GitRepo Volume Inadvertent Local Repository Access A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit gitRepo volumes to access local git repositories belonging to other pods on the same node. This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable. |
CVE-2025-1767
GHSA-3wgm-2gw2-vh5m |
| VCID-vctf-a4t5-q7a2 | Unverified Ownership in Kubernetes Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect. |
CVE-2020-8554
GHSA-j9wf-vvm6-4r9w |
| VCID-vj7p-66bc-7yam | Symlink Attack in kubectl cp The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0. |
CVE-2019-1002101
GHSA-34jx-wx69-9x8v |
| VCID-vu3k-upyc-x7av | Potential proxy IP restriction bypass in Kubernetes As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place. |
CVE-2020-8562
GHSA-qh36-44jv-c8xj |
| VCID-w9b7-vajk-3kdq | Kube-proxy may unintentionally forward traffic Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (`spec.ports[*].port`) as a LoadBalancer Service when the LoadBalancer controller does not set the `status.loadBalancer.ingress[].ip` field. Clusters where the LoadBalancer controller sets the `status.loadBalancer.ingress[].ip` field are unaffected. |
CVE-2021-25736
GHSA-35c7-w35f-xwgh |
| VCID-wpwc-fkd7-qugm | Denial of service in Kubernetes The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail. |
CVE-2020-8557
GHSA-55qj-gj3x-jq9r |
| VCID-wr54-j3ky-abfa | Kubernetes Nodes can delete themselves by adding an OwnerReference A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. |
CVE-2025-5187
GHSA-4x4m-3c2p-qppc |
| VCID-x5e9-nj8f-aye9 | kubernetes: improper validation of URL redirection in the Kubernetes API server allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints |
CVE-2018-1002102
|
| VCID-xcss-tfeh-w7a6 | kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal |
CVE-2019-11249
|
| VCID-xw76-5x4h-y3az | Sensitive Information leak via Log File in Kubernetes In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13. |
CVE-2020-8566
GHSA-5x96-j797-5qqw |
| VCID-zb2s-uwse-zfdf | Kubernetes kube-apiserver unauthorized access The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12. |
CVE-2019-11247
GHSA-fp37-c92q-4pwq |
| VCID-zexe-7ywv-cbcf | Kubernetes sets incorrect permissions on Windows containers logs A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. |
CVE-2024-5321
GHSA-82m2-cv7p-4m75 |
| VCID-zfkg-9qsx-83f1 | Kubernetes arbitrary file overwrite In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running. |
CVE-2017-1002102
GHSA-mm7g-f2gg-cw8g |