CVE-2019-11253

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

CVSS 3.1 · 7.5 High EPSS 25.9% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform and 2 more

CVE-2021-25743

ANSI escape characters in kubectl output are not being filtered

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2024-45310

runc can be confused to create empty files/directories on the host

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Docker Kubernetes Linux and 2 more

Products

Docker Kubernetes Linux Kernel and 2 more

CVE-2021-25736

Windows kube-proxy LoadBalancer contention

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Microsoft Redhat

Products

Kubernetes Windows Openshift

CVE-2017-1000056

kubernetes: Privilege escalation in the PodSecurityPolicy admission plugin

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2017-1002100

kubernetes: Incorrect default access permissions for Persistent Volumes

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2015-7561

OpenShift3: Private Docker images can be used by any user, once they are pulled to a node

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.

CVSS 3.0 · 3.1 Low EPSS 1.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2016-1905

server: patch operation should use patched object to check admission control

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.

CVSS 3.0 · 7.7 High EPSS 1.6% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2015-7528

OpenShift: pod log location must validate container if provided

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2016-1906

server: build config to a strategy that isn't allowed by policy

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

CVSS 3.0 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2022-3162

Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2022-3294

Node address isn't always verified when proxying

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

CVSS 3.1 · 6.6 Medium EPSS 1.6% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2023-3676

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS 3.1 · 8.8 High EPSS 13.2% KEV · Not listed

Vendors

Kubernetes Microsoft Redhat

Products

Kubernetes Windows Openshift

CVE-2023-3955

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed

Vendors

Kubernetes Microsoft Redhat

Products

Kubelet Kubernetes Windows and 1 more

CVE-2023-2728

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Ironic

CVE-2023-2727

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Ironic

CVE-2023-2431

Bypass of seccomp profile enforcement

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Kubernetes Redhat

Products

Fedora Kubernetes Openshift

CVE-2021-25749

runAsNonRoot logic bypass for Windows containers

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2021-25741

Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

CVSS 3.1 · 8.8 High EPSS 8.0% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2021-25737

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

CVSS 3.1 · 2.7 Low EPSS 1.3% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift