CVE-2021-25740: kubernetes Confused Deputy
CVSS: 3.5v2.0LowModified
AliasesUBUNTU-CVE-2021-25740DEBIAN-CVE-2021-25740CGA-3qp8-wrvv-wcmqCGA-97x3-jr34-r2r6CGA-c6g4-cprc-w95vCGA-c7jj-vcr4-q945CGA-ff27-78r5-c9hhCGA-hvr4-qcjh-pr5rCGA-jqfv-2763-m3gwCGA-m25q-3m34-j2hvCGA-qfxf-wcjw-jv4hCGA-qhmr-xg5p-vgvcCGA-rv9h-3885-p424CGA-v7x7-6c52-fp54CGA-v87x-4q7x-4gwwCGA-xpgg-72g3-w8jrGHSA-vw47-mr44-3jf9CGA-2jhv-rff5-f7q7CGA-5r6v-fxg5-xpj5CGA-63f2-jg5p-pwx4CGA-fw57-77vx-4q36CGA-g8x3-cq6j-xr3gCGA-jg2c-q932-2xgqCGA-mx7r-699f-x789CGA-wh2h-gm33-m58h
Published 20-09-2021Last modified 01-06-2026
Vulnerability summary
CVE-2021-25740 is a low (CVSS 3.5) Confused Deputy vulnerability in kubernetes. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 79.9% of scored vulnerabilities.
CVSS score
3.5/10
010
Low · v2.0 (NVD)EPSS score
1.95%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 10Timeline
- 20-09-2021PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
CVSS metrics
8 scores · 7 sources · 2 versionsLow 3.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Low 3.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.95% on 19-09-2026
19-09-202619-10-2026
EPSS score1.95%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-441Unintended Proxy or Intermediary ('Confused Deputy')The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Chainguard11 products
- kubeflow-pipelinesAll versions (No fix recorded)
- kubernetes-1.30All versions (No fix recorded)
- kubernetes-1.31All versions (No fix recorded)
- kubernetes-1.32All versions (No fix recorded)
- kubernetes-1.33All versions (No fix recorded)
Wolfi7 products
- kubeflow-pipelinesAll versions (No fix recorded)
- kubernetes-1.34All versions (No fix recorded)
- kubernetes-1.35All versions (No fix recorded)
- kubernetes-1.36All versions (No fix recorded)
- kubernetes-1.37All versions (No fix recorded)
Debian1 product
- kubernetes< 1.20.5+really1.20.2-1
K8s.io1 product
- kubernetes≤ 1.22.2
Kubernetes1 product
- kubernetesAll versions (No fix recorded) | na
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
6 vendors · 22 products
References
12 links- groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLEX Refsource MISCAdvisoryWEBMailing ListMitigationThird Party Advisory
- github.com/kubernetes/kubernetes/issues/103675X Refsource MISCREPORTWEBMitigationThird Party Advisory
