60 results (0.003 seconds)

CVSS: 7.5EPSS: 30%CPEs: 1EXPL: 0

30 Jun 2025 — Kubernetes releases compiled with vulnerable Go versions (prior to Go 1.21.11 / 1.22.4) are affected by a race condition in the os.RemoveAll function used during volume cleanup. A malicious container can exploit this by timing a symbolic link replacement to redirect the deletion operation outside the intended volume path. This can result in deletion of arbitrary files or directories on the host system, including data from other pods or host volumes, leading to data loss and potential privilege escalation. ... • https://github.com/kubernetes/kubernetes/issues/132267 • CWE-363: Race Condition Enabling Link Following •

CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0

23 Jun 2025 — A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. • https://github.com/kubernetes/kubernetes/issues/132151 • CWE-20: Improper Input Validation •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

18 Jul 2024 — A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. Se descubrió un problema de seguridad en clústeres de Kubernetes con nodos de Windows donde BUILTIN\Users pueden leer registros de contenedores y NT AUTHORITY\Authenticated Users pueden modificar registros de contenedores. A flaw was found in Kubernetes clusters with Windows nodes. BUILTIN\Users may be able... • https://github.com/kubernetes/kubernetes/issues/126161 • CWE-276: Incorrect Default Permissions •

CVSS: 3.3EPSS: 4%CPEs: 1EXPL: 2

22 Apr 2024 — A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/en... • https://github.com/FreySolarEye/Exploit-CVE-2024-31777 • CWE-20: Improper Input Validation CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •

CVSS: 9.0EPSS: 18%CPEs: 7EXPL: 0

14 Nov 2023 — A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ... • https://github.com/kubernetes/kubernetes/issues/121879 • CWE-20: Improper Input Validation •

CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 1

29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119595 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •

CVSS: 9.0EPSS: 35%CPEs: 6EXPL: 1

29 Aug 2023 — A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que pueda crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows. A vulnerability was found in Kuberne... • https://github.com/kubernetes/kubernetes/issues/119339 • CWE-20: Improper Input Validation CWE-269: Improper Privilege Management •

CVSS: 7.7EPSS: 3%CPEs: 4EXPL: 1

03 Jul 2023 — Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. A flaw was found in Kubernetes, wher... • https://github.com/Cgv-Dev/Metasploit-Module-TFM • CWE-20: Improper Input Validation •

CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0

03 Jul 2023 — Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. A flaw was found in Kubernetes, where users may be able to launch containers using images restricted by the ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together wi... • http://www.openwall.com/lists/oss-security/2023/07/06/2 • CWE-20: Improper Input Validation •

CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0

16 Jun 2023 — A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. A flaw was found in Kubernetes. • https://github.com/kubernetes/kubernetes/issues/118690 • CWE-1287: Improper Validation of Specified Type of Input •