# k8s.io/kubernetes (Go) vulnerabilities

50 known vulnerabilities (8 high, 30 medium, 9 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/k8s.io/kubernetes

## Advisories (50)

### [CVE-2025-13281](https://cve.now/CVE-2025-13281): Portworx Half-Blind SSRF in kube-controller-manager

- Severity: Medium 5.8
- Published: Dec 14, 2025
- Affected: fixed in 1.32.10; from 1.33.0-alpha.0, fixed in 1.33.6; from 1.34.0-alpha.0, fixed in 1.34.2; fixed in 1.32.10; from 1.33.0-alpha.0, fixed in 1.33.6; from 1.34.0-alpha.0, fixed in 1.34.2.

### [CVE-2025-5187](https://cve.now/CVE-2025-5187): Nodes can delete themselves by adding an OwnerReference

- Severity: Medium 6.7
- Published: Aug 27, 2025
- Affected: fixed in 1.31.12; from 1.32.0-alpha.0, fixed in 1.32.8; from 1.33.0-alpha.0, fixed in 1.33.4; fixed in 1.31.12; from 1.32.0-alpha.0, fixed in 1.32.8; from 1.33.0-alpha.0, fixed in 1.33.4.

### [CVE-2025-4563](https://cve.now/CVE-2025-4563): Nodes can bypass dynamic resource allocation authorization checks

- Severity: Low 2.7
- Published: Jun 23, 2025
- Affected: from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2; from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2.

### [CVE-2024-7598](https://cve.now/CVE-2024-7598): Network restriction bypass via race condition during namespace termination

- Severity: Low 3.1
- Published: Mar 20, 2025
- Affected: from 1.3.0.

### [CVE-2025-1767](https://cve.now/CVE-2025-1767): This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the…

- Severity: Medium 6.5
- Published: Mar 13, 2025
- Affected: through 1.32.3; all versions.

### [CVE-2024-9042](https://cve.now/CVE-2024-9042): This CVE affects only Windows worker nodes.

- Severity: Medium 5.9
- Published: Mar 13, 2025
- Affected: fixed in 1.29.13; from 1.30.0-alpha.0, fixed in 1.30.9; from 1.31.0-alpha.0, fixed in 1.31.5; from 1.32.0-alpha.0, fixed in 1.32.1; fixed in 1.29.13; from 1.30.0-alpha.0, fixed in 1.30.9; from 1.31.0-alpha.0, fixed in 1.31.5; from 1.32.0-alpha.0, fixed in 1.32.1.

### [CVE-2025-0426](https://cve.now/CVE-2025-0426): A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet…

- Severity: Medium 6.2
- Published: Feb 13, 2025
- Affected: fixed in 1.29.14; from 1.30.0, fixed in 1.30.10; from 1.31.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.2; from 1.32.0, fixed in 1.32.2; from 1.31.0, fixed in 1.31.6; from 1.30.0, fixed in 1.30.10; fixed in 1.29.14.

### [CVE-2024-10220](https://cve.now/CVE-2024-10220): Arbitrary command execution through gitRepo volume

- Severity: High 8.1
- Published: Nov 22, 2024
- Affected: fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3; fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3.

### [CVE-2024-0793](https://cve.now/CVE-2024-0793): Kube-controller-manager: malformed hpa v1 manifest causes crash

- Severity: High 7.7
- Published: Nov 17, 2024
- Affected: fixed in 1.27.0-alpha.1.

### [CVE-2024-5321](https://cve.now/CVE-2024-5321): Incorrect permissions on Windows containers logs

- Severity: Medium 6.1
- Published: Jul 18, 2024
- Affected: fixed in 1.27.16; from 1.28.0, fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3; fixed in 1.27.16; from 1.28.0, fixed in 1.28.12; from 1.29.0, fixed in 1.29.7; from 1.30.0, fixed in 1.30.3.

### [CVE-2024-3177](https://cve.now/CVE-2024-3177): Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

- Severity: Low 2.7
- Published: Apr 22, 2024
- Affected: fixed in 1.27.13; from 1.28.0, fixed in 1.28.9; from 1.29.0, fixed in 1.29.4; fixed in 1.27.13; from 1.29.0, fixed in 1.29.4; from 1.28.0, fixed in 1.28.9.

### [CVE-2023-5528](https://cve.now/CVE-2023-5528): Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

- Severity: High 7.2
- Published: Nov 14, 2023
- Affected: fixed in 1.25.16; from 1.26.0, fixed in 1.26.11; from 1.27.0, fixed in 1.27.8; from 1.28.0, fixed in 1.28.4; from 1.28.0, fixed in 1.28.4; from 1.27.0, fixed in 1.27.8; from 1.26.0, fixed in 1.26.11; fixed in 1.25.16.

### [CVE-2023-3955](https://cve.now/CVE-2023-3955): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

- Severity: High 8.8
- Published: Oct 31, 2023
- Affected: fixed in 1.24.17; from 1.25.0, fixed in 1.25.13; from 1.26.0, fixed in 1.26.8; from 1.27.0, fixed in 1.27.5; from 1.28.0, fixed in 1.28.1; from 1.28.0, fixed in 1.28.1; from 1.27.0, fixed in 1.27.5; from 1.26.0, fixed in 1.26.8; from 1.25.0, fixed in 1.25.13; fixed in 1.24.17.

### [CVE-2023-3676](https://cve.now/CVE-2023-3676): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

- Severity: High 8.8
- Published: Oct 31, 2023
- Affected: fixed in 1.24.17; from 1.25.0, fixed in 1.25.13; from 1.26.0, fixed in 1.26.8; from 1.27.0, fixed in 1.27.5; from 1.28.0, fixed in 1.28.1; from 1.28.0, fixed in 1.28.1; from 1.27.0, fixed in 1.27.5; from 1.26.0, fixed in 1.26.8; from 1.25.0, fixed in 1.25.13; fixed in 1.24.17.

### [CVE-2021-25736](https://cve.now/CVE-2021-25736): Windows kube-proxy LoadBalancer contention

- Severity: Medium 5.8
- Published: Oct 30, 2023
- Affected: fixed in 1.21.0.

### [CVE-2023-2728](https://cve.now/CVE-2023-2728): Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

- Severity: Medium 6.5
- Published: Jul 3, 2023
- Affected: fixed in 1.24.15; from 1.25.0, fixed in 1.25.11; from 1.26.0, fixed in 1.26.6; from 1.27.0, fixed in 1.27.3; from 1.27.0, fixed in 1.27.3; from 1.26.0, fixed in 1.26.6; from 1.25.0, fixed in 1.25.11; fixed in 1.24.15.

### [CVE-2023-2727](https://cve.now/CVE-2023-2727): Bypassing policies imposed by the ImagePolicyWebhook admission plugin

- Severity: Medium 6.5
- Published: Jul 3, 2023
- Affected: fixed in 1.24.15; from 1.25.0, fixed in 1.25.11; from 1.26.0, fixed in 1.26.6; from 1.27.0, fixed in 1.27.3; from 1.27.0, fixed in 1.27.3; from 1.26.0, fixed in 1.26.6; from 1.25.0, fixed in 1.25.11; fixed in 1.24.15.

### [CVE-2023-2431](https://cve.now/CVE-2023-2431): Bypass of seccomp profile enforcement

- Severity: Low 3.4
- Published: Jun 16, 2023
- Affected: fixed in 1.24.14; from 1.25.0, fixed in 1.25.10; from 1.26.0, fixed in 1.26.5; from 1.27.0, fixed in 1.27.2; fixed in 1.24.14; from 1.25.0, fixed in 1.25.10; from 1.26.0, fixed in 1.26.5; from 1.27.0, fixed in 1.27.2.

### [CVE-2022-3294](https://cve.now/CVE-2022-3294): Node address isn't always verified when proxying

- Severity: Medium 6.6
- Published: Mar 1, 2023
- Affected: from 1.22.0, fixed in 1.22.16; from 1.23.0, fixed in 1.23.14; from 1.24.0, fixed in 1.24.8; from 1.25.0, fixed in 1.25.4.

### [CVE-2022-3162](https://cve.now/CVE-2022-3162): Unauthorized read of Custom Resources

- Severity: Medium 6.5
- Published: Mar 1, 2023
- Affected: from 1.22.0, fixed in 1.22.16; from 1.23.0, fixed in 1.23.14; from 1.24.0, fixed in 1.24.8; from 1.25.0, fixed in 1.25.4.

### [CVE-2020-8562](https://cve.now/CVE-2020-8562): Bypass of Kubernetes API Server proxy TOCTOU

- Severity: Low 2.2
- Published: Feb 1, 2022
- Affected: from 1.21.0, through 1.21.1; from 1.20.0, through 1.20.7; from 1.19.0, through 1.19.11; through 1.18.19.

### [CVE-2021-25743](https://cve.now/CVE-2021-25743): ANSI escape characters in kubectl output are not being filtered

- Severity: Low 3.0
- Published: Jan 7, 2022
- Affected: fixed in 1.26.0-alpha.3.

### [CVE-2021-25741](https://cve.now/CVE-2021-25741): Symlink Exchange Can Allow Host Filesystem Access

- Severity: High 8.8
- Published: Sep 20, 2021
- Affected: fixed in 1.19.15; from 1.20.0, fixed in 1.20.11; from 1.21.0, fixed in 1.21.5; from 1.22.0, fixed in 1.22.2; fixed in 1.19.15; from 1.20.0, fixed in 1.20.11; from 1.21.0, fixed in 1.21.5; from 1.22.0, fixed in 1.22.2.

### [CVE-2021-25740](https://cve.now/CVE-2021-25740): Holes in EndpointSlice Validation Enable Host Network Hijack

- Severity: Low 3.1
- Published: Sep 20, 2021
- Affected: through 1.22.2.

### [CVE-2020-8561](https://cve.now/CVE-2020-8561): Webhook redirect in kube-apiserver

- Severity: Medium 4.1
- Published: Sep 20, 2021
- Affected: through 1.22.2.

### [CVE-2021-25737](https://cve.now/CVE-2021-25737): Holes in EndpointSlice Validation Enable Host Network Hijack

- Severity: Low 2.7
- Published: Sep 6, 2021
- Affected: from 1.16.0, fixed in 1.18.19; from 1.19.0, fixed in 1.19.11; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.1; from 1.16.0, fixed in 1.18.19; from 1.19.0, fixed in 1.19.11; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.1.

### [CVE-2021-25735](https://cve.now/CVE-2021-25735): Validating Admission Webhook does not observe some previous fields

- Severity: Medium 6.5
- Published: Sep 6, 2021
- Affected: from 1.20.0, fixed in 1.20.6; from 1.19.0, fixed in 1.19.10; fixed in 1.18.18; fixed in 1.18.18; from 1.19.0, fixed in 1.19.10; from 1.20.0, fixed in 1.20.6.

### [CVE-2020-8554](https://cve.now/CVE-2020-8554): Kubernetes man in the middle using LoadBalancer or ExternalIPs

- Severity: Medium 6.3
- Published: Jan 21, 2021
- Affected: through 1.22.0.

### [CVE-2020-8563](https://cve.now/CVE-2020-8563): Secret leaks in logs for vSphere Provider kube-controller-manager

- Severity: Medium 4.7
- Published: Dec 7, 2020
- Affected: fixed in 1.19.3.

### [CVE-2020-8564](https://cve.now/CVE-2020-8564): Docker config secrets leaked when file is malformed and loglevel \>= 4

- Severity: Medium 4.7
- Published: Dec 7, 2020
- Affected: fixed in 1.20.0-alpha.1.

### [CVE-2020-8565](https://cve.now/CVE-2020-8565): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \>= 9

- Severity: Medium 4.7
- Published: Dec 7, 2020
- Affected: fixed in 1.20.0-alpha.2.

### [CVE-2020-8566](https://cve.now/CVE-2020-8566): Ceph RBD adminSecrets exposed in logs when loglevel \>= 4

- Severity: Medium 4.7
- Published: Dec 7, 2020
- Affected: fixed in 1.17.13; from 1.18.0, fixed in 1.18.10; from 1.19.0, fixed in 1.19.3.

### [CVE-2020-8558](https://cve.now/CVE-2020-8558): Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

- Severity: Medium 5.4
- Published: Jul 27, 2020
- Affected: fixed in 1.16.11; from 1.17.0, fixed in 1.17.7; from 1.18.0, fixed in 1.18.4; from 1.18.0, fixed in 1.18.4; from 1.17.0, fixed in 1.17.7; fixed in 1.16.11.

### [CVE-2020-8557](https://cve.now/CVE-2020-8557): Kubernetes node disk Denial of Service by writing to container /etc/hosts

- Severity: Medium 5.5
- Published: Jul 23, 2020
- Affected: from 1.1.0, fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.6.

### [CVE-2020-8559](https://cve.now/CVE-2020-8559): Privilege escalation from compromised node to cluster

- Severity: Medium 6.4
- Published: Jul 22, 2020
- Affected: fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.7; fixed in 1.16.13; from 1.17.0, fixed in 1.17.9; from 1.18.0, fixed in 1.18.7.

### [CVE-2020-8555](https://cve.now/CVE-2020-8555): Kubernetes kube-controller-manager SSRF

- Severity: Medium 6.3
- Published: Jun 4, 2020
- Affected: fixed in 1.15.12; from 1.16.0, fixed in 1.16.9; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.1; from 1.18.0, fixed in 1.18.1; from 1.17.0, fixed in 1.17.4; from 1.16.0, fixed in 1.16.9; fixed in 1.15.12.

### [CVE-2020-8551](https://cve.now/CVE-2020-8551): Kubernetes kubelet denial of service

- Severity: Medium 4.3
- Published: Mar 27, 2020
- Affected: from 1.15.0, fixed in 1.15.10; from 1.16.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.2; from 1.15.0, fixed in 1.15.10; from 1.16.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.2.

### [CVE-2019-11251](https://cve.now/CVE-2019-11251): kubectl cp allows symlink directory traversal

- Severity: Medium 4.8
- Published: Feb 3, 2020
- Affected: from 1.13.10, fixed in 1.13.11; from 1.14.6, fixed in 1.14.7; from 1.15.3, fixed in 1.16.0; from 1.13.10, fixed in 1.13.11; from 1.14.6, fixed in 1.14.7; from 1.15.3, fixed in 1.16.0.

### [CVE-2019-11253](https://cve.now/CVE-2019-11253): Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

- Severity: High 7.5
- Published: Oct 17, 2019
- Affected: from 1.0.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.2; from 1.0.0, fixed in 1.13.12; from 1.14.0, fixed in 1.14.8; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.2.

### [CVE-2019-11250](https://cve.now/CVE-2019-11250): Kubernetes client-go logs authorization headers at debug verbosity levels

- Severity: Medium 4.7
- Published: Aug 29, 2019
- Affected: fixed in 1.16.0-beta.1.

### [CVE-2019-11245](https://cve.now/CVE-2019-11245): kubelet-started container uid changes to root after first restart or if image is already pulled to the node

- Severity: Medium 4.9
- Published: Aug 29, 2019
- Affected: from 1.13.0, fixed in 1.13.7; from 1.14.0, fixed in 1.14.3.

### [CVE-2019-11243](https://cve.now/CVE-2019-11243): In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials…

- Severity: Low 3.1
- Published: Apr 22, 2019
- Affected: from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1; from 1.12.0, fixed in 1.12.5; from 1.13.0, fixed in 1.13.1.

### [CVE-2019-1002101](https://cve.now/CVE-2019-1002101): kubectl cp path traversal

- Severity: Medium 6.4
- Published: Apr 1, 2019
- Affected: fixed in 1.11.9; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5; fixed in 1.11.9; from 1.12.0, fixed in 1.12.7; from 1.13.0, fixed in 1.13.5.

### [CVE-2019-1002100](https://cve.now/CVE-2019-1002100): In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API…

- Severity: Medium 6.5
- Published: Apr 1, 2019
- Affected: from 1.0.0, through 1.10.14; from 1.11.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.6; from 1.13.0, fixed in 1.13.4; from 1.0.0, fixed in 1.11.8; from 1.12.0, fixed in 1.12.6; from 1.13.0, fixed in 1.13.4.

### [CVE-2018-1002101](https://cve.now/CVE-2018-1002101): In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on…

- Severity: Medium 5.9
- Published: Dec 5, 2018
- Affected: from 1.9.0, fixed in 1.9.10; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.2; from 1.9.0, fixed in 1.9.10; from 1.10.0, fixed in 1.10.6; from 1.11.0, fixed in 1.11.2.

### [CVE-2018-1002100](https://cve.now/CVE-2018-1002100): In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned…

- Severity: Medium 4.2
- Published: Jun 1, 2018
- Affected: from 1.5.0, fixed in 1.9.6; from 1.5.0-alpha.0, fixed in 1.9.6.

### [CVE-2017-1002102](https://cve.now/CVE-2017-1002102): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap…

- Severity: High 7.1
- Published: Mar 13, 2018
- Affected: from 1.3.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.9; from 1.9.0, fixed in 1.9.4; from 1.3.0, fixed in 1.7.14; from 1.8.0, fixed in 1.8.9; from 1.9.0, fixed in 1.9.4.

### [CVE-2015-7561](https://cve.now/CVE-2015-7561): Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.

- Severity: Unrated
- Published: Aug 7, 2017
- Affected: fixed in 1.2.0-alpha.6.

### [CVE-2017-1000056](https://cve.now/CVE-2017-1000056): Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability…

- Severity: Unrated
- Published: Jul 13, 2017
- Affected: from 1.5.0, fixed in 1.5.5.

### [CVE-2015-5305](https://cve.now/CVE-2015-5305): Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files…

- Severity: Unrated
- Published: Nov 6, 2015
- Affected: fixed in 1.1.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/k8s.io/kubernetes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.