Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Kubernetes — Vulnerabilities & Security Advisories 104

Browse all 104 CVE security advisories affecting Kubernetes. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Kubernetes serves as an open-source container orchestration platform, automating the deployment, scaling, and management of containerized applications across distributed clusters. Its complex architecture, involving numerous interacting components like the API server and kubelet, historically exposes it to diverse vulnerability classes. Common issues include remote code execution (RCE) via unauthenticated API endpoints, privilege escalation through misconfigured role-based access controls, and cross-site scripting (XSS) in the web dashboard. With over 100 recorded CVEs, the platform has faced significant security challenges, including incidents where attackers exploited weak authentication mechanisms to gain cluster-wide control. These vulnerabilities often stem from default configurations or delayed patching of underlying dependencies. Consequently, securing Kubernetes requires rigorous network segmentation, strict identity management, and continuous monitoring to mitigate risks associated with its intricate service mesh and dynamic workload scheduling capabilities.

Top products by Kubernetes: Kubernetes ingress-nginx kubelet Kubernetes ingress-nginx Minikube Image Builder Kubernetes Secrets Store CSI Driver Kubernetes Java Client kube-apiserver kubernetes-client/java CSI Driver for NFS Kubernetes CSharp Client secrets-store-sync-controller azure-file-csi-driver csi-proxy kops secrets-store-csi-driver aws-iam-authenticator CSI Snapshotter kubernetes-csi external-provisioner k8s.gcr.io/defaultbackend
CVE ID Title CVSS Severity Published
CVE-2024-3744 Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs — azure-file-csi-driver CWE-532 6.5 Medium 2024-05-15
CVE-2024-3177 Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin — Kubernetes CWE-20 2.7 Low 2024-04-22
CVE-2023-5528 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation — kubelet CWE-20 7.2 High 2023-11-14
CVE-2022-3172 Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF) — kube-apiserver CWE-918 5.1 Medium 2023-11-03
CVE-2023-3893 Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation — csi-proxy CWE-20 8.8 High 2023-11-03
CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation — kubelet CWE-20 8.8 High 2023-10-31
CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation — kubelet CWE-20 8.8 High 2023-10-31
CVE-2021-25736 Windows kube-proxy LoadBalancer contention — Kubernetes 5.8 Medium 2023-10-30
CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation — ingress-nginx CWE-20 7.6 High 2023-10-25
CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution — ingress-nginx CWE-20 7.6 High 2023-10-25
CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive — ingress-nginx CWE-20 8.8 High 2023-10-25
CVE-2023-1943 Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode — kops CWE-250 8.0 High 2023-10-11
CVE-2023-2728 Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin — Kubernetes CWE-20 6.5 Medium 2023-07-03
CVE-2023-2727 Bypassing policies imposed by the ImagePolicyWebhook admission plugin — Kubernetes CWE-20 6.5 Medium 2023-07-03
CVE-2023-2431 Bypass of seccomp profile enforcement — Kubernetes CWE-1287 3.4 Low 2023-06-16
CVE-2023-2878 Kubernetes secrets-store-csi-driver discloses service account tokens in logs — secrets-store-csi-driver CWE-532 6.5 Medium 2023-06-07
CVE-2023-1944 [minikube] ssh server with default password — minikube CWE-259 8.4 High 2023-05-24
CVE-2023-1174 [minikube] Network Port exposure in minikube running on macOS using Docker driver — minikube CWE-266 9.8 Critical 2023-05-24
CVE-2021-25749 runAsNonRoot logic bypass for Windows containers — Kubernetes CWE-284 7.8 High 2023-05-24
CVE-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character — Kubernetes ingress-nginx CWE-20 7.6 High 2023-05-24
CVE-2022-3162 Unauthorized read of Custom Resources — Kubernetes CWE-23 6.5 Medium 2023-03-01
CVE-2022-3294 Node address isn't always verified when proxying — Kubernetes CWE-20 6.6 Medium 2023-03-01
CVE-2022-2385 AccessKeyID validation bypass — aws-iam-authenticator CWE-20 8.1 High 2022-07-12
CVE-2021-25746 Ingress-nginx directive injection via annotations — Kubernetes ingress-nginx CWE-20 7.6 High 2022-05-06
CVE-2021-25745 Ingress-nginx path can be pointed to service account token file — Kubernetes ingress-nginx CWE-20 7.6 High 2022-05-06
CVE-2020-8562 Bypass of Kubernetes API Server proxy TOCTOU — Kubernetes CWE-367 2.2 Low 2022-02-01
CVE-2021-25743 ANSI escape characters in kubectl output are not being filtered — Kubernetes CWE-150 3.0 Low 2022-01-07
CVE-2021-25742 Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces — Kubernetes ingress-nginx CWE-20 7.6 High 2021-10-29
CVE-2021-25738 Code exec via yaml parsing — Kubernetes Java Client CWE-20 6.7 Medium 2021-10-11
CVE-2021-25741 Symlink Exchange Can Allow Host Filesystem Access — Kubernetes CWE-20 8.8 High 2021-09-20

This page lists every published CVE security advisory associated with Kubernetes. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.