Kubernetes vulnerabilities
124 vulnerabilities
Known vulnerabilities in Kubernetes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 36 products.
Products
36- Kubernetes62 vulnerabilities
- Ingress Nginx21 vulnerabilities
- Cri O10 vulnerabilities
- Kubelet7 vulnerabilities
- Kubernetes Ingress Nginx4 vulnerabilities
- Image Builder3 vulnerabilities
- Kube Apiserver3 vulnerabilities
- Minikube3 vulnerabilities
- Java2 vulnerabilities
- Kubernetes Java Client2 vulnerabilities
- Kubernetes Secrets Store CSI Driver2 vulnerabilities
- Nginx Ingress Controller2 vulnerabilities
- Apiserver1 vulnerabilities
- Aws Iam Authenticator1 vulnerabilities
- Azure File Csi Driver1 vulnerabilities
- Container Storage Interface Snapshotter1 vulnerabilities
- CSI Driver For NFS1 vulnerabilities
- Csi Proxy1 vulnerabilities
- CSI Snapshotter1 vulnerabilities
- Csi Proxy1 vulnerabilities
- Dashboard1 vulnerabilities
- External Provisioner1 vulnerabilities
- External Resizer1 vulnerabilities
- External Snapshotter1 vulnerabilities
- K8S.Gcr.Io/Defaultbackend1 vulnerabilities
- Kops1 vulnerabilities
- Kube State Metrics1 vulnerabilities
- Kubernetes Csharp Client1 vulnerabilities
- Kubernetes Client/Java1 vulnerabilities
- Kubernetes Csi External Provisioner1 vulnerabilities
- Kubernetes Csi External Resizer1 vulnerabilities
- Kubernetes Csi External Snapshotter1 vulnerabilities
- Operations1 vulnerabilities
- Secrets Store Csi Driver1 vulnerabilities
- Secrets Store Csi Driver1 vulnerabilities
- Secrets Store Sync Controller1 vulnerabilities
CVE-2018-1000400kubernetescri-o
EPSS score2.01%
Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.CVE-2018-1002100debiankubernetes+3EPSS score1.67%
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.CVE-2018-1002102chainguardkubeflow-pipelines+5EPSS score0.62%
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.CVE-2018-1002105chainguardkubeflow-pipelines+47EPSS score86.98%
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.CVE-2018-1002103k8s.iominikube+1EPSS score0.70%
In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.CVE-2018-1002104k8s.ioingress-nginx+2EPSS score1.14%
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.CVE-2018-1002101chainguardkubeflow-pipelines+3EPSS score4.00%
In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.CVE-2018-18264kubernetesdashboardEPSS score70.37%
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.CVE-2021-25740chainguardkubeflow-pipelines+21EPSS score1.95%
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.CVE-2021-25742kubernetesingress-nginx+3EPSS score2.07%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.CVE-2021-25746kubernetesingress-nginx+1EPSS score1.44%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.CVE-2021-25737debiankubernetes+3EPSS score1.33%
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.CVE-2021-25738kubernetesjava+2EPSS score0.47%
Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.CVE-2021-25741chainguardkubeflow-pipelines+20EPSS score7.96%
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.CVE-2021-25745k8s.ioingress-nginx+3EPSS score1.18%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.CVE-2021-25735chainguardkubeflow-pipelines+5EPSS score5.38%
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.CVE-2021-25743chainguardaws-efs-csi-driver+30EPSS score0.78%
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.CVE-2021-25748k8s.ioingress-nginx+2EPSS score0.69%
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.CVE-2021-25736chainguardkubeflow-pipelines+7EPSS score0.92%
Kube-proxy
on Windows can unintentionally forward traffic to local processes
listening on the same port (“spec.ports[*].port”) as a LoadBalancer
Service when the LoadBalancer controller
does not set the “status.loadBalancer.ingress[].ip” field. Clusters
where the LoadBalancer controller sets the
“status.loadBalancer.ingress[].ip” field are unaffected.CVE-2021-25749kuberneteskubernetesEPSS score0.21%
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.