K8S.Io Kubernetes vulnerabilities

CVE-2020-8559 [MEDIUM] CWE-601 Privilege Escalation in Kubernetes Privilege Escalation in Kubernetes The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

CVE-2015-5305 [MEDIUM] CWE-22 Directory Traversal in Kubernetes Directory Traversal in Kubernetes Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

CVE-2023-2727 [MEDIUM] CWE-20 kube-apiserver vulnerable to policy bypass kube-apiserver vulnerable to policy bypass Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

CVE-2025-5187 [MEDIUM] CWE-863 Kubernetes Nodes can delete themselves by adding an OwnerReference Kubernetes Nodes can delete themselves by adding an OwnerReference A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be dele

CVE-2025-13281 [MEDIUM] CWE-918 kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected

CVE-2019-1002101 [MEDIUM] CWE-59 Symlink Attack in kubectl cp Symlink Attack in kubectl cp The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on

CVE-2021-25736 [MEDIUM] Kube-proxy may unintentionally forward traffic Kube-proxy may unintentionally forward traffic Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (`spec.ports[*].port`) as a LoadBalancer Service when the LoadBalancer controller does not set the `status.loadBalancer.ingress[].ip` field. Clusters where the LoadBalancer controller sets the `status.loadBalancer.ingress[].ip` field are unaffected.

CVE-2025-1767 [MEDIUM] CWE-20 Kubernetes GitRepo Volume Inadvertent Local Repository Access Kubernetes GitRepo Volume Inadvertent Local Repository Access A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit gitRepo volumes to access local git repositories belonging to other pods on the same node. This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the sam

CVE-2019-11251 [MEDIUM] CWE-59 Kubernetes kubectl cp Vulnerable to Symlink Attack Kubernetes kubectl cp Vulnerable to Symlink Attack The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink,

CVE-2024-9042 [MEDIUM] CWE-20 Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is runni

CVE-2018-1002100 [MEDIUM] CWE-20 Kubernetes arbitrary file overwrite Kubernetes arbitrary file overwrite In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

CVE-2020-8551 [MEDIUM] CWE-770 Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authentica

CVE-2017-1002102 [MEDIUM] CWE-284 Kubernetes arbitrary file overwrite Kubernetes arbitrary file overwrite In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

CVE-2024-5321 [HIGH] CWE-276 Kubernetes sets incorrect permissions on Windows containers logs Kubernetes sets incorrect permissions on Windows containers logs A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

CVE-2020-8565 [MEDIUM] CWE-532 Kubernetes client-go vulnerable to Sensitive Information Leak via Log File Kubernetes client-go vulnerable to Sensitive Information Leak via Log File In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.

CVE-2023-2431 [MEDIUM] CWE-1287 Kubelet vulnerable to bypass of seccomp profile enforcement Kubelet vulnerable to bypass of seccomp profile enforcement A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

CVE-2020-8566 Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

CVE-2020-8557 Denial of service in Kubernetes in k8s.io/kubernetes Denial of service in Kubernetes in k8s.io/kubernetes Denial of service in Kubernetes in k8s.io/kubernetes

CVE-2020-8563 Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes

CVE-2020-8564 [MEDIUM] CWE-532 Kubernetes Sensitive Information leak via Log File Kubernetes Sensitive Information leak via Log File In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.