CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-13281 – Portworx Half-Blind SSRF in kube-controller-manager
https://notcve.org/view.php?id=CVE-2025-13281
14 Dec 2025 — A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services). This update for govulncheck-vulndb fixes the following issues. • https://github.com/kubernetes/kubernetes/issues/135525 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2025-9708 – Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks
https://notcve.org/view.php?id=CVE-2025-9708
16 Sep 2025 — A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation. • https://github.com/kubernetes/kubernetes/issues/134063 • CWE-295: Improper Certificate Validation •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2025-5187 – Nodes can delete themselves by adding an OwnerReference
https://notcve.org/view.php?id=CVE-2025-5187
27 Aug 2025 — A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. Existe una vulnerabilidad en el controlador de admisión NodeRestriction de los clústeres de Kubernetes, donde los usuarios de los nodos pueden elimina... • https://github.com/kubernetes/kubernetes/issues/133471 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 30%CPEs: 1EXPL: 0NotCVE-2025-0003 – Symlink Race in Kubernetes Volume Cleanup Enables Host Filesystem Deletion
https://notcve.org/view.php?id=NotCVE-2025-0003
30 Jun 2025 — Kubernetes releases compiled with vulnerable Go versions (prior to Go 1.21.11 / 1.22.4) are affected by a race condition in the os.RemoveAll function used during volume cleanup. A malicious container can exploit this by timing a symbolic link replacement to redirect the deletion operation outside the intended volume path. This can result in deletion of arbitrary files or directories on the host system, including data from other pods or host volumes, leading to data loss and potential privilege escalation. ... • https://github.com/kubernetes/kubernetes/issues/132267 • CWE-363: Race Condition Enabling Link Following •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-4563 – Nodes can bypass dynamic resource allocation authorization checks
https://notcve.org/view.php?id=CVE-2025-4563
23 Jun 2025 — A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. • https://github.com/kubernetes/kubernetes/issues/132151 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-5321 – Incorrect permissions on Windows containers logs
https://notcve.org/view.php?id=CVE-2024-5321
18 Jul 2024 — A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. Se descubrió un problema de seguridad en clústeres de Kubernetes con nodos de Windows donde BUILTIN\Users pueden leer registros de contenedores y NT AUTHORITY\Authenticated Users pueden modificar registros de contenedores. A flaw was found in Kubernetes clusters with Windows nodes. BUILTIN\Users may be able... • https://github.com/kubernetes/kubernetes/issues/126161 • CWE-276: Incorrect Default Permissions •
CVSS: 3.3EPSS: 6%CPEs: 1EXPL: 2CVE-2024-3177 – Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
https://notcve.org/view.php?id=CVE-2024-3177
22 Apr 2024 — A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/en... • https://github.com/FreySolarEye/Exploit-CVE-2024-31777 • CWE-20: Improper Input Validation CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 9.0EPSS: 18%CPEs: 7EXPL: 0CVE-2023-5528 – Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-5528
14 Nov 2023 — A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ... • https://github.com/kubernetes/kubernetes/issues/121879 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1CVE-2023-3955 – Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-3955
29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119595 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 40%CPEs: 6EXPL: 1CVE-2023-3676 – Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-3676
29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que pueda crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119339 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •