6.3

CVE-2021-25736: kubernetes Process Control

CVSS: 6.3v3.1MediumModified
AliasesCGA-4v86-xv4v-gf99CGA-6h69-prv3-c34vCGA-f793-9x57-4qq8
Published 30-10-2023Last modified 12-06-2025
Open JSON

Vulnerability summary

CVE-2021-25736 is a medium (CVSS 6.3) Process Control vulnerability in kubernetes. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.4% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v3.1 (NVD)
EPSS score
0.92%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 6
OPENSUSE-SU-2025:15424-1CGA-G7X6-8CH3-6HQWCGA-GXX3-3MWR-6Q27CGA-H5CJ-JFJV-735QCGA-MCFQ-MMGC-QFMHCGA-MHJF-45W8-8626

Timeline

  1. 30-10-2023
    PublishedVulnerability first disclosed.
  2. 12-06-2025
    Last modifiedVulnerability information updated.

Description

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.92%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

0.00 pp

From 0.92% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • kubeflow-pipelinesAll versions (No fix recorded)
  • nodetaintAll versions (No fix recorded)
  • spark-operatorAll versions (No fix recorded)
Wolfi3 products
  • kubeflow-pipelinesAll versions (No fix recorded)
  • nodetaintAll versions (No fix recorded)
  • spark-operatorAll versions (No fix recorded)
K8s.io1 product
  • kubernetes< 1.21.0
Kubernetes1 product
  • kubernetes≤ v1.20.5 | ≥ 1.18.0, < 1.18.18 | ≥ 1.19.0, < 1.19.10 | ≥ 1.20.0, < 1.20.6

4 vendors · 8 products

References

8 links