Skip to main content
cve.nowby Sazabi
← Go
GoPackage

k8s.io/kubernetes

50 known vulnerabilities (8 high, 30 medium, 9 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
50 · 8 high, 30 medium, 9 low
Registry
pkg.go.dev

Advisories 50

  • CVE-2025-13281Medium 5.8

    Portworx Half-Blind SSRF in kube-controller-manager

    Affected: fixed in 1.32.10; from 1.33.0-alpha.0, fixed in 1.33.6; from 1.34.0-alpha.0, fixed in 1.34.2; fixed in 1.32.10; from 1.33.0-alpha.0, fixed in 1.33.6; from 1.34.0-alpha.0, fixed in 1.34.2.

  • CVE-2025-5187Medium 6.7

    Nodes can delete themselves by adding an OwnerReference

    Affected: fixed in 1.31.12; from 1.32.0-alpha.0, fixed in 1.32.8; from 1.33.0-alpha.0, fixed in 1.33.4; fixed in 1.31.12; from 1.32.0-alpha.0, fixed in 1.32.8; from 1.33.0-alpha.0, fixed in 1.33.4.

  • Nodes can bypass dynamic resource allocation authorization checks

    Affected: from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2; from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2.

  • Network restriction bypass via race condition during namespace termination

    Affected: from 1.3.0.

  • CVE-2025-1767Medium 6.5

    This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the…

    Affected: through 1.32.3; all versions.

  • CVE-2024-9042Medium 5.9

    This CVE affects only Windows worker nodes.

    Affected: fixed in 1.29.13; from 1.30.0-alpha.0, fixed in 1.30.9; from 1.31.0-alpha.0, fixed in 1.31.5; from 1.32.0-alpha.0, fixed in 1.32.1; fixed in 1.29.13; from 1.30.0-alpha.0, fixed in 1.30.9; from 1.31.0-alpha.0, fixed in 1.31.5; from 1.32.0-alpha.0, fixed in 1.32.1.

  • CVE-2025-0426Medium 6.2

    A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet…

    Affected: fixed in 1.29.14; from 1.30.0, fixed in 1.30.10; from 1.31.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.2; from 1.32.0, fixed in 1.32.2; from 1.31.0, fixed in 1.31.6; from 1.30.0, fixed in 1.30.10; fixed in 1.29.14.

  • Arbitrary command execution through gitRepo volume

    Affected: fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3; fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3.

  • Kube-controller-manager: malformed hpa v1 manifest causes crash

    Affected: fixed in 1.27.0-alpha.1.

  • CVE-2024-5321Medium 6.1

    Incorrect permissions on Windows containers logs

    Affected: fixed in 1.27.16; from 1.28.0, fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3; fixed in 1.27.16; from 1.28.0, fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3.

  • Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

    Affected: fixed in 1.27.13; from 1.28.0, fixed in 1.28.9; from 1.29.0, fixed in 1.29.4; fixed in 1.27.13; from 1.29.0, fixed in 1.29.4; from 1.28.0, fixed in 1.28.9.

  • Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

    Affected: fixed in 1.25.16; from 1.26.0, fixed in 1.26.11; from 1.27.0, fixed in 1.27.8; from 1.28.0, fixed in 1.28.4; from 1.28.0, fixed in 1.28.4; from 1.27.0, fixed in 1.27.8; from 1.26.0, fixed in 1.26.11; fixed in 1.25.16.

  • Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    Affected: fixed in 1.24.17; from 1.25.0, fixed in 1.25.13; from 1.26.0, fixed in 1.26.8; from 1.27.0, fixed in 1.27.5; from 1.28.0, fixed in 1.28.1; from 1.28.0, fixed in 1.28.1; from 1.27.0, fixed in 1.27.5; from 1.26.0, fixed in 1.26.8; from 1.25.0, fixed in 1.25.13; fixed in 1.24.17.

  • Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    Affected: fixed in 1.24.17; from 1.25.0, fixed in 1.25.13; from 1.26.0, fixed in 1.26.8; from 1.27.0, fixed in 1.27.5; from 1.28.0, fixed in 1.28.1; from 1.28.0, fixed in 1.28.1; from 1.27.0, fixed in 1.27.5; from 1.26.0, fixed in 1.26.8; from 1.25.0, fixed in 1.25.13; fixed in 1.24.17.

  • CVE-2021-25736Medium 5.8

    Windows kube-proxy LoadBalancer contention

    Affected: fixed in 1.21.0.

Show all 50 advisoriesShow fewer advisories
  • CVE-2023-2728Medium 6.5

    Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

    Affected: fixed in 1.24.15; from 1.25.0, fixed in 1.25.11; from 1.26.0, fixed in 1.26.6; from 1.27.0, fixed in 1.27.3; from 1.27.0, fixed in 1.27.3; from 1.26.0, fixed in 1.26.6; from 1.25.0, fixed in 1.25.11; fixed in 1.24.15.

  • CVE-2023-2727Medium 6.5

    Bypassing policies imposed by the ImagePolicyWebhook admission plugin

    Affected: fixed in 1.24.15; from 1.25.0, fixed in 1.25.11; from 1.26.0, fixed in 1.26.6; from 1.27.0, fixed in 1.27.3; from 1.27.0, fixed in 1.27.3; from 1.26.0, fixed in 1.26.6; from 1.25.0, fixed in 1.25.11; fixed in 1.24.15.

  • Bypass of seccomp profile enforcement

    Affected: fixed in 1.24.14; from 1.25.0, fixed in 1.25.10; from 1.26.0, fixed in 1.26.5; from 1.27.0, fixed in 1.27.2; fixed in 1.24.14; from 1.25.0, fixed in 1.25.10; from 1.26.0, fixed in 1.26.5; from 1.27.0, fixed in 1.27.2.

  • CVE-2022-3294Medium 6.6

    Node address isn't always verified when proxying

    Affected: from 1.22.0, fixed in 1.22.16; from 1.23.0, fixed in 1.23.14; from 1.24.0, fixed in 1.24.8; from 1.25.0, fixed in 1.25.4.

  • CVE-2022-3162Medium 6.5

    Unauthorized read of Custom Resources

    Affected: from 1.22.0, fixed in 1.22.16; from 1.23.0, fixed in 1.23.14; from 1.24.0, fixed in 1.24.8; from 1.25.0, fixed in 1.25.4.

  • Bypass of Kubernetes API Server proxy TOCTOU

    Affected: from 1.21.0, through 1.21.1; from 1.20.0, through 1.20.7; from 1.19.0, through 1.19.11; through 1.18.19.

  • ANSI escape characters in kubectl output are not being filtered

    Affected: fixed in 1.26.0-alpha.3.

  • Symlink Exchange Can Allow Host Filesystem Access

    Affected: fixed in 1.19.15; from 1.20.0, fixed in 1.20.11; from 1.21.0, fixed in 1.21.5; from 1.22.0, fixed in 1.22.2; fixed in 1.19.15; from 1.20.0, fixed in 1.20.11; from 1.21.0, fixed in 1.21.5; from 1.22.0, fixed in 1.22.2.

  • Holes in EndpointSlice Validation Enable Host Network Hijack

    Affected: through 1.22.2.

  • CVE-2020-8561Medium 4.1

    Webhook redirect in kube-apiserver

    Affected: through 1.22.2.

  • Holes in EndpointSlice Validation Enable Host Network Hijack

    Affected: from 1.16.0, fixed in 1.18.19; from 1.19.0, fixed in 1.19.11; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.1; from 1.16.0, fixed in 1.18.19; from 1.19.0, fixed in 1.19.11; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.1.

  • CVE-2021-25735Medium 6.5

    Validating Admission Webhook does not observe some previous fields

    Affected: from 1.20.0, fixed in 1.20.6; from 1.19.0, fixed in 1.19.10; fixed in 1.18.18; fixed in 1.18.18; from 1.19.0, fixed in 1.19.10; from 1.20.0, fixed in 1.20.6.

  • CVE-2020-8554Medium 6.3

    Kubernetes man in the middle using LoadBalancer or ExternalIPs

    Affected: through 1.22.0.

  • CVE-2020-8563Medium 4.7

    Secret leaks in logs for vSphere Provider kube-controller-manager

    Affected: fixed in 1.19.3.

  • CVE-2020-8564Medium 4.7

    Docker config secrets leaked when file is malformed and loglevel >= 4

    Affected: fixed in 1.20.0-alpha.1.

  • CVE-2020-8565Medium 4.7

    Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

    Affected: fixed in 1.20.0-alpha.2.

  • CVE-2020-8566Medium 4.7

    Ceph RBD adminSecrets exposed in logs when loglevel >= 4

    Affected: fixed in 1.17.13; from 1.18.0, fixed in 1.18.10; from 1.19.0, fixed in 1.19.3.

  • CVE-2020-8558Medium 5.4

    Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

    Affected: fixed in 1.16.11; from 1.17.0, fixed in 1.17.7; from 1.18.0, fixed in 1.18.4; from 1.18.0, fixed in 1.18.4; from 1.17.0, fixed in 1.17.7; fixed in 1.16.11.

  • CVE-2020-8557Medium 5.5

    Kubernetes node disk Denial of Service by writing to container /etc/hosts

    Affected: from 1.1.0, fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.6.

  • CVE-2020-8559Medium 6.4

    Privilege escalation from compromised node to cluster

    Affected: fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.7; fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.7.

  • CVE-2020-8555Medium 6.3

    Kubernetes kube-controller-manager SSRF

    Affected: fixed in 1.15.12; from 1.16.0, fixed in 1.16.9; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.1; from 1.18.0, fixed in 1.18.1; from 1.17.0, fixed in 1.17.4; from 1.16.0, fixed in 1.16.9; fixed in 1.15.12.

  • CVE-2020-8551Medium 4.3

    Kubernetes kubelet denial of service

    Affected: from 1.15.0, fixed in 1.15.10; from 1.16.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.2; from 1.15.0, fixed in 1.15.10; from 1.16.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.2.

  • CVE-2019-11251Medium 4.8

    kubectl cp allows symlink directory traversal

    Affected: from 1.13.10, fixed in 1.13.11; from 1.14.6, fixed in 1.14.7; from 1.15.3, fixed in 1.16.0; from 1.13.10, fixed in 1.13.11; from 1.14.6, fixed in 1.14.7; from 1.15.3, fixed in 1.16.0.

  • Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    Affected: from 1.0.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.2; from 1.0.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.2.

  • CVE-2019-11250Medium 4.7

    Kubernetes client-go logs authorization headers at debug verbosity levels

    Affected: fixed in 1.16.0-beta.1.

  • CVE-2019-11245Medium 4.9

    kubelet-started container uid changes to root after first restart or if image is already pulled to the node

    Affected: from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3.

  • In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials…

    Affected: from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

  • kubectl cp path traversal

    Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; fixed in 1.11.9; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5.

  • In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API…

    Affected: from 1.0.0, through 1.10.14; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.6; from 1.13.0, fixed in 1.13.4; from 1.0.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.6; from 1.13.0, fixed in 1.13.4.

  • In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on…

    Affected: from 1.9.0, fixed in 1.9.10; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.2; from 1.9.0, fixed in 1.9.10; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.2.

  • In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned…

    Affected: from 1.5.0, fixed in 1.9.6; from 1.5.0-alpha.0, fixed in 1.9.6.

  • In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap…

    Affected: from 1.3.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.9; from 1.9.0, fixed in 1.9.4; from 1.3.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.9; from 1.9.0, fixed in 1.9.4.

  • Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.

    Affected: fixed in 1.2.0-alpha.6.

  • Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability…

    Affected: from 1.5.0, fixed in 1.5.5.

  • Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files…

    Affected: fixed in 1.1.1.