K8S.Io Kubernetes vulnerabilities

CVE-2019-11253 [HIGH] CWE-20 XML Entity Expansion and Improper Input Validation in Kubernetes API server XML Entity Expansion and Improper Input Validation in Kubernetes API server Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to

CVE-2023-3676 [HIGH] CWE-20 Kubernetes privilege escalation vulnerability Kubernetes privilege escalation vulnerability A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVE-2022-3294 Kubernetes vulnerable to validation bypass in k8s.io/kubernetes Kubernetes vulnerable to validation bypass in k8s.io/kubernetes Kubernetes vulnerable to validation bypass in k8s.io/kubernetes

CVE-2023-3955 [HIGH] CWE-20 Kubernetes privilege escalation vulnerability Kubernetes privilege escalation vulnerability A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVE-2024-10220 [HIGH] CWE-22 Kubernetes kubelet arbitrary command execution Kubernetes kubelet arbitrary command execution The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

CVE-2018-1002101 [MEDIUM] CWE-78 Kubernetes Arbitrary Command Injection Kubernetes Arbitrary Command Injection In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. ### Specific Go Packages Affected k8s.io/kubernetes/pkg/util/mount

CVE-2023-5528 [HIGH] CWE-20 Kubernetes Improper Input Validation vulnerability Kubernetes Improper Input Validation vulnerability A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

CVE-2020-8558 [HIGH] CWE-420 Improper Authentication in Kubernetes Improper Authentication in Kubernetes A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other

CVE-2021-25741 [HIGH] CWE-20 Files or Directories Accessible to External Parties in kubernetes Files or Directories Accessible to External Parties in kubernetes A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

CVE-2017-1000056 [CRITICAL] CWE-862 Kubernetes Privilege Escalation Kubernetes Privilege Escalation Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CVE-2019-1002100 [MEDIUM] CWE-770 Kubernetes DoS Vulnerability Kubernetes DoS Vulnerability In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.

CVE-2019-11243 [HIGH] CWE-212 Kubernetes did not effectively clear service account credentials Kubernetes did not effectively clear service account credentials In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using re

CVE-2020-8555 [MEDIUM] CWE-918 Server Side Request Forgery (SSRF) in Kubernetes Server Side Request Forgery (SSRF) in Kubernetes The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services)

CVE-2023-2728 [MEDIUM] CWE-20 Kubernetes mountable secrets policy bypass Kubernetes mountable secrets policy bypass Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kube

CVE-2021-25735 [MEDIUM] CWE-284 Access Restriction Bypass in kube-apiserver Access Restriction Bypass in kube-apiserver A vulnerability in Kubernetes `kube-apiserver` could allow node updates to bypass a _Validating Admission Webhook_ and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission con

CVE-2020-8554 [MEDIUM] CWE-283 Unverified Ownership in Kubernetes Unverified Ownership in Kubernetes Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to sim

CVE-2019-11250 [MEDIUM] CWE-532 Kubernetes client-go library logs may disclose credentials to unauthorized users Kubernetes client-go library logs may disclose credentials to unauthorized users The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at hig

CVE-2019-11245 Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes

CVE-2024-0793 [HIGH] CWE-20 Kubernetes Nil pointer dereference in KCM after v1 HPA patch request Kubernetes Nil pointer dereference in KCM after v1 HPA patch request A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

CVE-2022-3162 Kubernetes vulnerable to path traversal in k8s.io/kubernetes Kubernetes vulnerable to path traversal in k8s.io/kubernetes Kubernetes vulnerable to path traversal in k8s.io/kubernetes