# cve.now: Kubernetes

The newest entries naming Kubernetes as an affected vendor (up to 200), of 107 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116472](https://cve.now/CVE-2026-116472.md): ingress-nginx mirror-target self-DOS (CVSS 2.7)
- [CVE-2026-2270](https://cve.now/CVE-2026-2270.md): StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation (CVSS 5.9)
- [CVE-2026-76654](https://cve.now/CVE-2026-76654.md): Subpath symlinking on Windows nodes permits NTLM coercion (CVSS 5.8)
- [CVE-2026-19444](https://cve.now/CVE-2026-19444.md): Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes (CVSS 6.5)
- [CVE-2026-15687](https://cve.now/CVE-2026-15687.md): Path traversal via non-tar copyDirectoryFromPod (CVSS 2.7)
- [CVE-2026-3864](https://cve.now/CVE-2026-3864.md): CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server (CVSS 6.5)
- [CVE-2026-4342](https://cve.now/CVE-2026-4342.md): ingress-nginx comment-based nginx configuration injection (CVSS 8.8)
- [CVE-2026-3288](https://cve.now/CVE-2026-3288.md): ingress-nginx rewrite-target nginx configuration injection (CVSS 8.8)
- [CVE-2025-15566](https://cve.now/CVE-2025-15566.md): ingress-nginx auth-proxy-set-headers nginx configuration injection (CVSS 8.8)
- [CVE-2026-24514](https://cve.now/CVE-2026-24514.md): ingress-nginx Admission Controller denial of service (CVSS 6.5)
- [CVE-2026-24513](https://cve.now/CVE-2026-24513.md): ingress-nginx auth-url protection bypass (CVSS 3.1)
- [CVE-2026-24512](https://cve.now/CVE-2026-24512.md): ingress-nginx auth-method nginx configuration injection (CVSS 8.8)
- [CVE-2026-1580](https://cve.now/CVE-2026-1580.md): ingress-nginx auth-method nginx configuration injection (CVSS 8.8)
- [CVE-2025-13281](https://cve.now/CVE-2025-13281.md): Portworx Half-Blind SSRF in kube-controller-manager (CVSS 5.8)
- [CVE-2025-9708](https://cve.now/CVE-2025-9708.md): Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks (CVSS 6.8)
- [CVE-2025-7445](https://cve.now/CVE-2025-7445.md): Kubernetes secrets-store-sync-controller discloses service account tokens in logs (CVSS 6.5)
- [CVE-2025-5187](https://cve.now/CVE-2025-5187.md): Nodes can delete themselves by adding an OwnerReference (CVSS 6.7)
- [CVE-2025-7342](https://cve.now/CVE-2025-7342.md): VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override (CVSS 7.5)
- [CVE-2025-4563](https://cve.now/CVE-2025-4563.md): Nodes can bypass dynamic resource allocation authorization checks (CVSS 2.7)
- [CVE-2025-24514](https://cve.now/CVE-2025-24514.md): ingress-nginx controller - configuration injection via unsanitized auth-url annotation (CVSS 8.8)
- [CVE-2025-24513](https://cve.now/CVE-2025-24513.md): ingress-nginx controller - auth secret file path traversal vulnerability (CVSS 4.8)
- [CVE-2025-1098](https://cve.now/CVE-2025-1098.md): ingress-nginx controller - configuration injection via unsanitized mirror annotations (CVSS 8.8)
- [CVE-2025-1097](https://cve.now/CVE-2025-1097.md): ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation (CVSS 8.8)
- [CVE-2025-1974](https://cve.now/CVE-2025-1974.md): ingress-nginx admission controller RCE escalation (CVSS 9.8)
- [CVE-2024-7598](https://cve.now/CVE-2024-7598.md): Network restriction bypass via race condition during namespace termination (CVSS 3.1)
- [CVE-2025-1767](https://cve.now/CVE-2025-1767.md): This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same (CVSS 6.5)
- [CVE-2024-9042](https://cve.now/CVE-2024-9042.md): This CVE affects only Windows worker nodes. (CVSS 5.9)
- [CVE-2025-0426](https://cve.now/CVE-2025-0426.md): A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read (CVSS 6.2)
- [CVE-2024-10220](https://cve.now/CVE-2024-10220.md): Arbitrary command execution through gitRepo volume (CVSS 8.1)
- [CVE-2024-9594](https://cve.now/CVE-2024-9594.md): VM images built with Image Builder with some providers use default credentials during builds (CVSS 6.3)
- [CVE-2024-9486](https://cve.now/CVE-2024-9486.md): VM images built with Image Builder and Proxmox provider use default credentials (CVSS 9.8)
- [CVE-2024-7646](https://cve.now/CVE-2024-7646.md): A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the \`networking.k8s.io\` or \`ex (CVSS 8.8)
- [CVE-2024-5321](https://cve.now/CVE-2024-5321.md): Incorrect permissions on Windows containers logs (CVSS 6.1)
- [CVE-2024-3744](https://cve.now/CVE-2024-3744.md): Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs (CVSS 6.5)
- [CVE-2024-3177](https://cve.now/CVE-2024-3177.md): Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 2.7)
- [CVE-2023-5528](https://cve.now/CVE-2023-5528.md): Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation (CVSS 7.2)
- [CVE-2022-3172](https://cve.now/CVE-2022-3172.md): Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF) (CVSS 5.1)
- [CVE-2023-3893](https://cve.now/CVE-2023-3893.md): Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation (CVSS 8.8)
- [CVE-2023-3955](https://cve.now/CVE-2023-3955.md): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation (CVSS 8.8)
- [CVE-2023-3676](https://cve.now/CVE-2023-3676.md): Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation (CVSS 8.8)
- [CVE-2021-25736](https://cve.now/CVE-2021-25736.md): Windows kube-proxy LoadBalancer contention (CVSS 5.8)
- [CVE-2023-5044](https://cve.now/CVE-2023-5044.md): Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (CVSS 7.6)
- [CVE-2023-5043](https://cve.now/CVE-2023-5043.md): Ingress nginx annotation injection causes arbitrary command execution (CVSS 7.6)
- [CVE-2022-4886](https://cve.now/CVE-2022-4886.md): Ingress-nginx \`path\` sanitization can be bypassed with \`log\_format\` directive (CVSS 8.8)
- [CVE-2023-1943](https://cve.now/CVE-2023-1943.md): Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode (CVSS 8.0)
- [CVE-2023-2728](https://cve.now/CVE-2023-2728.md): Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin (CVSS 6.5)
- [CVE-2023-2727](https://cve.now/CVE-2023-2727.md): Bypassing policies imposed by the ImagePolicyWebhook admission plugin (CVSS 6.5)
- [CVE-2023-2431](https://cve.now/CVE-2023-2431.md): Bypass of seccomp profile enforcement (CVSS 3.4)
- [CVE-2023-2878](https://cve.now/CVE-2023-2878.md): Kubernetes secrets-store-csi-driver discloses service account tokens in logs (CVSS 6.5)
- [CVE-2023-1944](https://cve.now/CVE-2023-1944.md): \[minikube\] ssh server with default password (CVSS 8.4)
- [CVE-2023-1174](https://cve.now/CVE-2023-1174.md): \[minikube\] Network Port exposure in minikube running on macOS using Docker driver (CVSS 9.8)
- [CVE-2021-25749](https://cve.now/CVE-2021-25749.md): runAsNonRoot logic bypass for Windows containers (CVSS 7.8)
- [CVE-2021-25748](https://cve.now/CVE-2021-25748.md): Ingress-nginx \`path\` sanitization can be bypassed with newline character (CVSS 7.6)
- [CVE-2022-3294](https://cve.now/CVE-2022-3294.md): Node address isn't always verified when proxying (CVSS 6.6)
- [CVE-2022-3162](https://cve.now/CVE-2022-3162.md): Unauthorized read of Custom Resources (CVSS 6.5)
- [CVE-2022-2385](https://cve.now/CVE-2022-2385.md): AccessKeyID validation bypass (CVSS 8.1)
- [CVE-2021-25746](https://cve.now/CVE-2021-25746.md): Ingress-nginx directive injection via annotations (CVSS 7.6)
- [CVE-2021-25745](https://cve.now/CVE-2021-25745.md): Ingress-nginx path can be pointed to service account token file (CVSS 7.6)
- [CVE-2020-8562](https://cve.now/CVE-2020-8562.md): Bypass of Kubernetes API Server proxy TOCTOU (CVSS 2.2)
- [CVE-2021-25743](https://cve.now/CVE-2021-25743.md): ANSI escape characters in kubectl output are not being filtered (CVSS 3.0)
- [CVE-2021-25742](https://cve.now/CVE-2021-25742.md): Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces (CVSS 7.6)
- [CVE-2021-25738](https://cve.now/CVE-2021-25738.md): Code exec via yaml parsing (CVSS 6.7)
- [CVE-2021-25741](https://cve.now/CVE-2021-25741.md): Symlink Exchange Can Allow Host Filesystem Access (CVSS 8.8)
- [CVE-2021-25740](https://cve.now/CVE-2021-25740.md): Holes in EndpointSlice Validation Enable Host Network Hijack (CVSS 3.1)
- [CVE-2020-8561](https://cve.now/CVE-2020-8561.md): Webhook redirect in kube-apiserver (CVSS 4.1)
- [CVE-2021-25737](https://cve.now/CVE-2021-25737.md): Holes in EndpointSlice Validation Enable Host Network Hijack (CVSS 2.7)
- [CVE-2021-25735](https://cve.now/CVE-2021-25735.md): Validating Admission Webhook does not observe some previous fields (CVSS 6.5)
- [CVE-2020-8570](https://cve.now/CVE-2020-8570.md): Kubernetes Java client libraries unvalidated path traversal in Copy implementation (no CVSS)
- [CVE-2020-8569](https://cve.now/CVE-2020-8569.md): Kubernetes CSI snapshot-controller DoS (CVSS 4.3)
- [CVE-2020-8568](https://cve.now/CVE-2020-8568.md): Kubernetes Secrets Store CSI Driver sync/rotate directory traversal (CVSS 5.8)
- [CVE-2020-8567](https://cve.now/CVE-2020-8567.md): Kubernetes Secrets Store CSI Driver plugin directory traversals (CVSS 4.9)
- [CVE-2020-8554](https://cve.now/CVE-2020-8554.md): Kubernetes man in the middle using LoadBalancer or ExternalIPs (CVSS 6.3)
- [CVE-2020-8563](https://cve.now/CVE-2020-8563.md): Secret leaks in logs for vSphere Provider kube-controller-manager (CVSS 4.7)
- [CVE-2020-8564](https://cve.now/CVE-2020-8564.md): Docker config secrets leaked when file is malformed and loglevel \>= 4 (CVSS 4.7)
- [CVE-2020-8565](https://cve.now/CVE-2020-8565.md): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \>= 9 (CVSS 4.7)
- [CVE-2020-8566](https://cve.now/CVE-2020-8566.md): Ceph RBD adminSecrets exposed in logs when loglevel \>= 4 (CVSS 4.7)
- [CVE-2020-8553](https://cve.now/CVE-2020-8553.md): Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names (CVSS 5.9)
- [CVE-2020-8558](https://cve.now/CVE-2020-8558.md): Kubernetes node setting allows for neighboring hosts to bypass localhost boundary (CVSS 5.4)
- [CVE-2020-8557](https://cve.now/CVE-2020-8557.md): Kubernetes node disk Denial of Service by writing to container /etc/hosts (CVSS 5.5)
- [CVE-2019-11252](https://cve.now/CVE-2019-11252.md): Credential leakage when failing to mount (CVSS 5.9)
- [CVE-2020-8559](https://cve.now/CVE-2020-8559.md): Privilege escalation from compromised node to cluster (CVSS 6.4)
- [CVE-2020-8555](https://cve.now/CVE-2020-8555.md): Kubernetes kube-controller-manager SSRF (CVSS 6.3)
- [CVE-2019-11254](https://cve.now/CVE-2019-11254.md): Kubernetes API Server denial of service vulnerability from malicious YAML payloads (CVSS 6.5)
- [CVE-2020-8552](https://cve.now/CVE-2020-8552.md): Kubernetes API server denial of service (CVSS 5.3)
- [CVE-2020-8551](https://cve.now/CVE-2020-8551.md): Kubernetes kubelet denial of service (CVSS 4.3)
- [CVE-2019-11251](https://cve.now/CVE-2019-11251.md): kubectl cp allows symlink directory traversal (CVSS 4.8)
- [CVE-2018-1002104](https://cve.now/CVE-2018-1002104.md): Versions \< 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. (CVSS 5.3)
- [CVE-2019-11255](https://cve.now/CVE-2019-11255.md): Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation (CVSS 4.8)
- [CVE-2018-1002102](https://cve.now/CVE-2018-1002102.md): Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints (CVSS 2.6)
- [CVE-2019-11253](https://cve.now/CVE-2019-11253.md): Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack (CVSS 7.5)
- [CVE-2019-11250](https://cve.now/CVE-2019-11250.md): Kubernetes client-go logs authorization headers at debug verbosity levels (CVSS 4.7)
- [CVE-2019-11249](https://cve.now/CVE-2019-11249.md): kubectl cp allows symlink directory traversal (CVSS 4.8)
- [CVE-2019-11248](https://cve.now/CVE-2019-11248.md): Kubernetes kubelet exposes /debug/pprof info on healthz port (CVSS 6.5)
- [CVE-2019-11247](https://cve.now/CVE-2019-11247.md): Kubernetes kube-apiserver allows access to custom resources via wrong scope (CVSS 5.0)
- [CVE-2019-11246](https://cve.now/CVE-2019-11246.md): kubectl cp allows symlink directory traversal (CVSS 6.4)
- [CVE-2019-11245](https://cve.now/CVE-2019-11245.md): kubelet-started container uid changes to root after first restart or if image is already pulled to the node (CVSS 4.9)
- [CVE-2019-11244](https://cve.now/CVE-2019-11244.md): kubectl creates world-writeable cached schema files (CVSS 3.3)
- [CVE-2019-11243](https://cve.now/CVE-2019-11243.md): In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials r (CVSS 3.1)
- [CVE-2019-1002101](https://cve.now/CVE-2019-1002101.md): kubectl cp path traversal (CVSS 6.4)
- [CVE-2019-1002100](https://cve.now/CVE-2019-1002100.md): In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Se (CVSS 6.5)
- [CVE-2018-1002105](https://cve.now/CVE-2018-1002105.md): In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the (CVSS 9.8)
- [CVE-2018-1002103](https://cve.now/CVE-2018-1002103.md): In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. (CVSS 8.1)
- [CVE-2018-1002101](https://cve.now/CVE-2018-1002101.md): In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi (CVSS 5.9)
- [CVE-2018-1002100](https://cve.now/CVE-2018-1002100.md): In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned f (CVSS 4.2)
- [CVE-2017-1002102](https://cve.now/CVE-2017-1002102.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec (CVSS 7.1)
- [CVE-2017-1002101](https://cve.now/CVE-2017-1002101.md): In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with (CVSS 8.8)
- [CVE-2017-1002100](https://cve.now/CVE-2017-1002100.md): Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kubernetes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.