# cve.now: Kubernetes

The newest entries affecting Kubernetes (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-2270](https://cve.now/CVE-2026-2270.md): StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation (CVSS 5.9, Kubernetes)
- [CVE-2026-76654](https://cve.now/CVE-2026-76654.md): Subpath symlinking on Windows nodes permits NTLM coercion (CVSS 5.8, Kubernetes)
- [CVE-2026-110353](https://cve.now/CVE-2026-110353.md): HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncate (CVSS 7.5, HAProxy)
- [CVE-2026-110354](https://cve.now/CVE-2026-110354.md): HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via a (CVSS 7.5, HAProxy)
- [CVE-2026-105223](https://cve.now/CVE-2026-105223.md): maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification (CVSS 9.1, maclof kubernetes-client)
- [CVE-2026-19444](https://cve.now/CVE-2026-19444.md): Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes (CVSS 6.5, Kubernetes)
- [CVE-2026-15687](https://cve.now/CVE-2026-15687.md): Path traversal via non-tar copyDirectoryFromPod (CVSS 2.7, kubernetes-client/java)
- [CVE-2026-4342](https://cve.now/CVE-2026-4342.md): ingress-nginx comment-based nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2026-3288](https://cve.now/CVE-2026-3288.md): ingress-nginx rewrite-target nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx)
- [CVE-2025-15566](https://cve.now/CVE-2025-15566.md): ingress-nginx auth-proxy-set-headers nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx)
- [CVE-2026-24514](https://cve.now/CVE-2026-24514.md): ingress-nginx Admission Controller denial of service (CVSS 6.5, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2026-24513](https://cve.now/CVE-2026-24513.md): ingress-nginx auth-url protection bypass (CVSS 3.1, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2026-24512](https://cve.now/CVE-2026-24512.md): ingress-nginx auth-method nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2026-1580](https://cve.now/CVE-2026-1580.md): ingress-nginx auth-method nginx configuration injection (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2025-13281](https://cve.now/CVE-2025-13281.md): Portworx Half-Blind SSRF in kube-controller-manager (CVSS 5.8, Kubernetes · k8s.io/kubernetes)
- [CVE-2025-9708](https://cve.now/CVE-2025-9708.md): Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks (CVSS 6.8, Kubernetes CSharp Client · KubernetesClient)
- [CVE-2025-5187](https://cve.now/CVE-2025-5187.md): Nodes can delete themselves by adding an OwnerReference (CVSS 6.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2025-4563](https://cve.now/CVE-2025-4563.md): Nodes can bypass dynamic resource allocation authorization checks (CVSS 2.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2025-24514](https://cve.now/CVE-2025-24514.md): ingress-nginx controller - configuration injection via unsanitized auth-url annotation (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2025-24513](https://cve.now/CVE-2025-24513.md): ingress-nginx controller - auth secret file path traversal vulnerability (CVSS 4.8, kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2025-1098](https://cve.now/CVE-2025-1098.md): ingress-nginx controller - configuration injection via unsanitized mirror annotations (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2025-1097](https://cve.now/CVE-2025-1097.md): ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation (CVSS 8.8, kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2025-1974](https://cve.now/CVE-2025-1974.md): ingress-nginx admission controller RCE escalation (CVSS 9.8, kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2024-7598](https://cve.now/CVE-2024-7598.md): Network restriction bypass via race condition during namespace termination (CVSS 3.1, Kubernetes kube-apiserver · k8s.io/kubernetes/cmd/kube-a… +1)
- [CVE-2025-1767](https://cve.now/CVE-2025-1767.md): This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same (CVSS 6.5, Kubernetes Kubelet · k8s.io/kubernetes)
- [CVE-2024-9042](https://cve.now/CVE-2024-9042.md): This CVE affects only Windows worker nodes. (CVSS 5.9, Kubernetes Kubelet · k8s.io/kubernetes)
- [CVE-2025-0426](https://cve.now/CVE-2025-0426.md): A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read (CVSS 6.2, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2024-12226](https://cve.now/CVE-2024-12226.md): In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in cle (CVSS 6.5, Octopus Deploy Kubernetes Worker or Kubernetes Agent)
- [CVE-2024-10220](https://cve.now/CVE-2024-10220.md): Arbitrary command execution through gitRepo volume (CVSS 8.1, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2024-0793](https://cve.now/CVE-2024-0793.md): Kube-controller-manager: malformed hpa v1 manifest causes crash (CVSS 7.7, kube-controller-manager · Red Hat OpenShift Container Pl… +1)
- [CVE-2024-7646](https://cve.now/CVE-2024-7646.md): A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the \`networking.k8s.io\` or \`ex (CVSS 8.8, Kubernetes ingress-nginx · github.com/kubernetes/ingress-ng…)
- [CVE-2024-5321](https://cve.now/CVE-2024-5321.md): Incorrect permissions on Windows containers logs (CVSS 6.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2024-3177](https://cve.now/CVE-2024-3177.md): Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 2.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-5528](https://cve.now/CVE-2023-5528.md): Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation (CVSS 7.2, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2022-3172](https://cve.now/CVE-2022-3172.md): Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF) (CVSS 5.1, Kubernetes kube-apiserver)
- [CVE-2023-3955](https://cve.now/CVE-2023-3955.md): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation (CVSS 8.8, Kubernetes kubelet · k8s.io/kubernetes +1)
- [CVE-2023-3676](https://cve.now/CVE-2023-3676.md): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation (CVSS 8.8, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2021-25736](https://cve.now/CVE-2021-25736.md): Windows kube-proxy LoadBalancer contention (CVSS 5.8, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-5044](https://cve.now/CVE-2023-5044.md): Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2023-5043](https://cve.now/CVE-2023-5043.md): Ingress nginx annotation injection causes arbitrary command execution (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2022-4886](https://cve.now/CVE-2022-4886.md): Ingress-nginx \`path\` sanitization can be bypassed with \`log\_format\` directive (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2022-3248](https://cve.now/CVE-2022-3248.md): Openshift api admission checks does not enforce "custom-host" permissions (CVSS 4.4, kubernetes · Red Hat Advanced Cluster Management for Kub… +3)
- [CVE-2023-2728](https://cve.now/CVE-2023-2728.md): Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-2727](https://cve.now/CVE-2023-2727.md): Bypassing policies imposed by the ImagePolicyWebhook admission plugin (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2023-2431](https://cve.now/CVE-2023-2431.md): Bypass of seccomp profile enforcement (CVSS 3.4, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25748](https://cve.now/CVE-2021-25748.md): Ingress-nginx \`path\` sanitization can be bypassed with newline character (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2021-25749](https://cve.now/CVE-2021-25749.md): runAsNonRoot logic bypass for Windows containers (CVSS 7.8, Kubernetes)
- [CVE-2022-3162](https://cve.now/CVE-2022-3162.md): Unauthorized read of Custom Resources (CVSS 6.5, Kubernetes · k8s.io/kubernetes +1)
- [CVE-2022-3294](https://cve.now/CVE-2022-3294.md): Node address isn't always verified when proxying (CVSS 6.6, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2021-4178](https://cve.now/CVE-2021-4178.md): A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. (no CVSS, kubernetes-client · io.fabric8:kubernetes-client)
- [CVE-2021-25746](https://cve.now/CVE-2021-25746.md): Ingress-nginx directive injection via annotations (CVSS 7.6, Kubernetes ingress-nginx)
- [CVE-2021-25745](https://cve.now/CVE-2021-25745.md): Ingress-nginx path can be pointed to service account token file (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2020-8562](https://cve.now/CVE-2020-8562.md): Bypass of Kubernetes API Server proxy TOCTOU (CVSS 2.2, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25743](https://cve.now/CVE-2021-25743.md): ANSI escape characters in kubectl output are not being filtered (CVSS 3.0, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25742](https://cve.now/CVE-2021-25742.md): Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces (CVSS 7.6, Kubernetes ingress-nginx)
- [CVE-2021-25738](https://cve.now/CVE-2021-25738.md): Code exec via yaml parsing (CVSS 6.7, Kubernetes Java Client · io.kubernetes:client-java)
- [CVE-2021-25741](https://cve.now/CVE-2021-25741.md): Symlink Exchange Can Allow Host Filesystem Access (CVSS 8.8, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25740](https://cve.now/CVE-2021-25740.md): Holes in EndpointSlice Validation Enable Host Network Hijack (CVSS 3.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-8561](https://cve.now/CVE-2020-8561.md): Webhook redirect in kube-apiserver (CVSS 4.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25737](https://cve.now/CVE-2021-25737.md): Holes in EndpointSlice Validation Enable Host Network Hijack (CVSS 2.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2021-25735](https://cve.now/CVE-2021-25735.md): Validating Admission Webhook does not observe some previous fields (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-8570](https://cve.now/CVE-2020-8570.md): Kubernetes Java client libraries unvalidated path traversal in Copy implementation (no CVSS, Kubernetes Java Client · io.kubernetes:client-java)
- [CVE-2020-8568](https://cve.now/CVE-2020-8568.md): Kubernetes Secrets Store CSI Driver sync/rotate directory traversal (CVSS 5.8, Kubernetes Secrets Store CSI Driver · sigs.k8s.io/secrets-s…)
- [CVE-2020-8567](https://cve.now/CVE-2020-8567.md): Kubernetes Secrets Store CSI Driver plugin directory traversals (CVSS 4.9, Kubernetes Secrets Store CSI Driver · github.com/hashico… +2)
- [CVE-2020-8554](https://cve.now/CVE-2020-8554.md): Kubernetes man in the middle using LoadBalancer or ExternalIPs (CVSS 6.3, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-8563](https://cve.now/CVE-2020-8563.md): Secret leaks in logs for vSphere Provider kube-controller-manager (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-8564](https://cve.now/CVE-2020-8564.md): Docker config secrets leaked when file is malformed and loglevel \>= 4 (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-8565](https://cve.now/CVE-2020-8565.md): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \>= 9 (CVSS 4.7, Kubernetes · k8s.io/client-go +1)
- [CVE-2020-8566](https://cve.now/CVE-2020-8566.md): Ceph RBD adminSecrets exposed in logs when loglevel \>= 4 (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-8553](https://cve.now/CVE-2020-8553.md): Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names (CVSS 5.9, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2020-8558](https://cve.now/CVE-2020-8558.md): Kubernetes node setting allows for neighboring hosts to bypass localhost boundary (CVSS 5.4, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-8557](https://cve.now/CVE-2020-8557.md): Kubernetes node disk Denial of Service by writing to container /etc/hosts (CVSS 5.5, Kubernetes · k8s.io/kubernetes/pkg/kubelet +1)
- [CVE-2019-11252](https://cve.now/CVE-2019-11252.md): Credential leakage when failing to mount (CVSS 5.9, Kubernetes)
- [CVE-2020-8559](https://cve.now/CVE-2020-8559.md): Privilege escalation from compromised node to cluster (CVSS 6.4, Kubernetes · k8s.io/apimachinery +1)
- [CVE-2020-8555](https://cve.now/CVE-2020-8555.md): Kubernetes kube-controller-manager SSRF (CVSS 6.3, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11254](https://cve.now/CVE-2019-11254.md): Kubernetes API Server denial of service vulnerability from malicious YAML payloads (CVSS 6.5, Kubernetes · gopkg.in/yaml.v2 +1)
- [CVE-2020-8552](https://cve.now/CVE-2020-8552.md): Kubernetes API server denial of service (CVSS 5.3, Kubernetes · k8s.io/apiserver)
- [CVE-2020-8551](https://cve.now/CVE-2020-8551.md): Kubernetes kubelet denial of service (CVSS 4.3, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11251](https://cve.now/CVE-2019-11251.md): kubectl cp allows symlink directory traversal (CVSS 4.8, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11255](https://cve.now/CVE-2019-11255.md): Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation (CVSS 4.8, kubernetes-csi external-provisioner · kubernetes-csi ext… +4)
- [CVE-2018-1002102](https://cve.now/CVE-2018-1002102.md): Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints (CVSS 2.6, Kubernetes)
- [CVE-2019-11253](https://cve.now/CVE-2019-11253.md): Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack (CVSS 7.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11250](https://cve.now/CVE-2019-11250.md): Kubernetes client-go logs authorization headers at debug verbosity levels (CVSS 4.7, Kubernetes · k8s.io/client-go +1)
- [CVE-2019-11249](https://cve.now/CVE-2019-11249.md): kubectl cp allows symlink directory traversal (CVSS 4.8, Kubernetes)
- [CVE-2019-11248](https://cve.now/CVE-2019-11248.md): Kubernetes kubelet exposes /debug/pprof info on healthz port (CVSS 6.5, Kubernetes)
- [CVE-2019-11247](https://cve.now/CVE-2019-11247.md): Kubernetes kube-apiserver allows access to custom resources via wrong scope (CVSS 5.0, Kubernetes · k8s.io/apiextensions-apiserver)
- [CVE-2019-11246](https://cve.now/CVE-2019-11246.md): kubectl cp allows symlink directory traversal (CVSS 6.4, Kubernetes)
- [CVE-2019-11245](https://cve.now/CVE-2019-11245.md): kubelet-started container uid changes to root after first restart or if image is already pulled to the node (CVSS 4.9, Kubernetes · k8s.io/kubernetes/cmd/kubelet +1)
- [CVE-2019-11243](https://cve.now/CVE-2019-11243.md): In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials r (CVSS 3.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-11244](https://cve.now/CVE-2019-11244.md): kubectl creates world-writeable cached schema files (CVSS 3.3, Kubernetes · k8s.io/client-go)
- [CVE-2019-1002101](https://cve.now/CVE-2019-1002101.md): kubectl cp path traversal (CVSS 6.4, Kubernetes · k8s.io/kubernetes)
- [CVE-2019-1002100](https://cve.now/CVE-2019-1002100.md): In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Se (CVSS 6.5, Kubernetes · k8s.io/kubernetes)
- [CVE-2018-1002101](https://cve.now/CVE-2018-1002101.md): In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi (CVSS 5.9, Kubernetes · k8s.io/kubernetes)
- [CVE-2018-1002105](https://cve.now/CVE-2018-1002105.md): In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the (CVSS 9.8, Kubernetes · github.com/kubernetes/kubernetes)
- [CVE-2018-1002100](https://cve.now/CVE-2018-1002100.md): In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned f (CVSS 4.2, Kubernetes · k8s.io/kubernetes)
- [CVE-2017-1002101](https://cve.now/CVE-2017-1002101.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with (CVSS 8.8, Kubernetes)
- [CVE-2017-1002102](https://cve.now/CVE-2017-1002102.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec (CVSS 7.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2017-1002100](https://cve.now/CVE-2017-1002100.md): Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to (no CVSS, Kubernetes)
- [CVE-2015-7561](https://cve.now/CVE-2015-7561.md): Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. (no CVSS, k8s.io/kubernetes)
- [CVE-2017-1000056](https://cve.now/CVE-2017-1000056.md): Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to (no CVSS, k8s.io/kubernetes)
- [CVE-2015-5305](https://cve.now/CVE-2015-5305.md): Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files v (no CVSS, k8s.io/kubernetes · github.com/kubernetes/kubernetes)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/kubernetes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.