Kubernetes vulnerabilities
The newest vulnerabilities affecting Kubernetes, up to 200. Subscribe by RSS.
- CVE-2026-2270StatefulSet and ControllerRevision write permissions allow cross-namespace pod creationKubernetes
- CVE-2026-76654Subpath symlinking on Windows nodes permits NTLM coercionKubernetes
- CVE-2026-110353HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncateHAProxy
- CVE-2026-110354HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via aHAProxy
- CVE-2026-105223maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verificationmaclof kubernetes-client
- CVE-2026-19444Kubernetes kubectl cp path traversal on Windows allows arbitrary file writesKubernetes
- CVE-2026-15687Path traversal via non-tar copyDirectoryFromPodkubernetes-client/java
- CVE-2026-4342ingress-nginx comment-based nginx configuration injectionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-3288ingress-nginx rewrite-target nginx configuration injectionKubernetes ingress-nginx
- CVE-2025-15566ingress-nginx auth-proxy-set-headers nginx configuration injectionKubernetes ingress-nginx
- CVE-2026-24514ingress-nginx Admission Controller denial of serviceKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-24513ingress-nginx auth-url protection bypassKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-24512ingress-nginx auth-method nginx configuration injectionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-1580ingress-nginx auth-method nginx configuration injectionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-13281Portworx Half-Blind SSRF in kube-controller-managerKubernetes · k8s.io/kubernetes
- CVE-2025-9708Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacksKubernetes CSharp Client · KubernetesClient
- CVE-2025-5187Nodes can delete themselves by adding an OwnerReferenceKubernetes · k8s.io/kubernetes
- CVE-2025-4563Nodes can bypass dynamic resource allocation authorization checksKubernetes · k8s.io/kubernetes
- CVE-2025-24514ingress-nginx controller - configuration injection via unsanitized auth-url annotationkubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-24513ingress-nginx controller - auth secret file path traversal vulnerabilitykubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-1098ingress-nginx controller - configuration injection via unsanitized mirror annotationskubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-1097ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotationkubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-1974ingress-nginx admission controller RCE escalationkubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2024-7598Network restriction bypass via race condition during namespace terminationKubernetes kube-apiserver · k8s.io/kubernetes/cmd/kube-a… +1
- CVE-2025-1767This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same Kubernetes Kubelet · k8s.io/kubernetes
- CVE-2024-9042This CVE affects only Windows worker nodes.Kubernetes Kubelet · k8s.io/kubernetes
- CVE-2025-0426A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet readKubernetes kubelet · k8s.io/kubernetes
- CVE-2024-12226In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cleOctopus Deploy Kubernetes Worker or Kubernetes Agent
- CVE-2024-10220Arbitrary command execution through gitRepo volumeKubernetes kubelet · k8s.io/kubernetes
- CVE-2024-0793Kube-controller-manager: malformed hpa v1 manifest causes crashkube-controller-manager · Red Hat OpenShift Container Pl… +1
- CVE-2024-7646A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `exKubernetes ingress-nginx · github.com/kubernetes/ingress-ng…
- CVE-2024-5321Incorrect permissions on Windows containers logsKubernetes · k8s.io/kubernetes
- CVE-2024-3177Bypassing mountable secrets policy imposed by the ServiceAccount admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-5528Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalationKubernetes kubelet · k8s.io/kubernetes
- CVE-2022-3172Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)Kubernetes kube-apiserver
- CVE-2023-3955Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationKubernetes kubelet · k8s.io/kubernetes +1
- CVE-2023-3676Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationKubernetes kubelet · k8s.io/kubernetes
- CVE-2021-25736Windows kube-proxy LoadBalancer contentionKubernetes · k8s.io/kubernetes
- CVE-2023-5044Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotationKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2023-5043Ingress nginx annotation injection causes arbitrary command executionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2022-4886Ingress-nginx `path` sanitization can be bypassed with `log_format` directiveKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2022-3248Openshift api admission checks does not enforce "custom-host" permissionskubernetes · Red Hat Advanced Cluster Management for Kub… +3
- CVE-2023-2728Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-2727Bypassing policies imposed by the ImagePolicyWebhook admission pluginKubernetes · k8s.io/kubernetes
- CVE-2023-2431Bypass of seccomp profile enforcementKubernetes · k8s.io/kubernetes
- CVE-2021-25748Ingress-nginx `path` sanitization can be bypassed with newline characterKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2021-25749runAsNonRoot logic bypass for Windows containersKubernetes
- CVE-2022-3162Unauthorized read of Custom ResourcesKubernetes · k8s.io/kubernetes +1
- CVE-2022-3294Node address isn't always verified when proxyingKubernetes · github.com/kubernetes/kubernetes +1
- CVE-2021-4178A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.kubernetes-client · io.fabric8:kubernetes-client
- CVE-2021-25746Ingress-nginx directive injection via annotationsKubernetes ingress-nginx
- CVE-2021-25745Ingress-nginx path can be pointed to service account token fileKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2020-8562Bypass of Kubernetes API Server proxy TOCTOUKubernetes · k8s.io/kubernetes
- CVE-2021-25743ANSI escape characters in kubectl output are not being filteredKubernetes · k8s.io/kubernetes
- CVE-2021-25742Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesKubernetes ingress-nginx
- CVE-2021-25738Code exec via yaml parsingKubernetes Java Client · io.kubernetes:client-java
- CVE-2021-25741Symlink Exchange Can Allow Host Filesystem AccessKubernetes · k8s.io/kubernetes
- CVE-2021-25740Holes in EndpointSlice Validation Enable Host Network HijackKubernetes · k8s.io/kubernetes
- CVE-2020-8561Webhook redirect in kube-apiserverKubernetes · k8s.io/kubernetes
- CVE-2021-25737Holes in EndpointSlice Validation Enable Host Network HijackKubernetes · k8s.io/kubernetes
- CVE-2021-25735Validating Admission Webhook does not observe some previous fieldsKubernetes · k8s.io/kubernetes
- CVE-2020-8570Kubernetes Java client libraries unvalidated path traversal in Copy implementationKubernetes Java Client · io.kubernetes:client-java
- CVE-2020-8568Kubernetes Secrets Store CSI Driver sync/rotate directory traversalKubernetes Secrets Store CSI Driver · sigs.k8s.io/secrets-s…
- CVE-2020-8567Kubernetes Secrets Store CSI Driver plugin directory traversalsKubernetes Secrets Store CSI Driver · github.com/hashico… +2
- CVE-2020-8554Kubernetes man in the middle using LoadBalancer or ExternalIPsKubernetes · k8s.io/kubernetes
- CVE-2020-8563Secret leaks in logs for vSphere Provider kube-controller-managerKubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-8564Docker config secrets leaked when file is malformed and loglevel >= 4Kubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-8565Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9Kubernetes · k8s.io/client-go +1
- CVE-2020-8566Ceph RBD adminSecrets exposed in logs when loglevel >= 4Kubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-8553Kubernetes ingress-nginx Compromise of auth via subset/superset namespace namesKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2020-8558Kubernetes node setting allows for neighboring hosts to bypass localhost boundaryKubernetes · k8s.io/kubernetes
- CVE-2020-8557Kubernetes node disk Denial of Service by writing to container /etc/hostsKubernetes · k8s.io/kubernetes/pkg/kubelet +1
- CVE-2019-11252Credential leakage when failing to mountKubernetes
- CVE-2020-8559Privilege escalation from compromised node to clusterKubernetes · k8s.io/apimachinery +1
- CVE-2020-8555Kubernetes kube-controller-manager SSRFKubernetes · k8s.io/kubernetes
- CVE-2019-11254Kubernetes API Server denial of service vulnerability from malicious YAML payloadsKubernetes · gopkg.in/yaml.v2 +1
- CVE-2020-8552Kubernetes API server denial of serviceKubernetes · k8s.io/apiserver
- CVE-2020-8551Kubernetes kubelet denial of serviceKubernetes · k8s.io/kubernetes
- CVE-2019-11251kubectl cp allows symlink directory traversalKubernetes · k8s.io/kubernetes
- CVE-2019-11255Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutationkubernetes-csi external-provisioner · kubernetes-csi ext… +4
- CVE-2018-1002102Kubernetes API server follows unvalidated redirects from streaming Kubelet endpointsKubernetes
- CVE-2019-11253Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attackKubernetes · k8s.io/kubernetes
- CVE-2019-11250Kubernetes client-go logs authorization headers at debug verbosity levelsKubernetes · k8s.io/client-go +1
- CVE-2019-11249kubectl cp allows symlink directory traversalKubernetes
- CVE-2019-11248Kubernetes kubelet exposes /debug/pprof info on healthz portKubernetes
- CVE-2019-11247Kubernetes kube-apiserver allows access to custom resources via wrong scopeKubernetes · k8s.io/apiextensions-apiserver
- CVE-2019-11246kubectl cp allows symlink directory traversalKubernetes
- CVE-2019-11245kubelet-started container uid changes to root after first restart or if image is already pulled to the nodeKubernetes · k8s.io/kubernetes/cmd/kubelet +1
- CVE-2019-11243In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials rKubernetes · k8s.io/kubernetes
- CVE-2019-11244kubectl creates world-writeable cached schema filesKubernetes · k8s.io/client-go
- CVE-2019-1002101kubectl cp path traversalKubernetes · k8s.io/kubernetes
- CVE-2019-1002100In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API SeKubernetes · k8s.io/kubernetes
- CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on WiKubernetes · k8s.io/kubernetes
- CVE-2018-1002105In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in theKubernetes · github.com/kubernetes/kubernetes
- CVE-2018-1002100In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned fKubernetes · k8s.io/kubernetes
- CVE-2017-1002101In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with Kubernetes
- CVE-2017-1002102In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projecKubernetes · k8s.io/kubernetes
- CVE-2017-1002100Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set toKubernetes
- CVE-2015-7561Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.k8s.io/kubernetes
- CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability tok8s.io/kubernetes
- CVE-2015-5305Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files vk8s.io/kubernetes · github.com/kubernetes/kubernetes