CVE-2025-24514

ingress-nginx controller - configuration injection via unsanitized auth-url annotation

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

CVSS 3.1 · 8.8 High EPSS 37.3% KEV · Not listed

Vendors

Kubernetes

Products

Ingress-nginx

CVE-2025-7342

VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override

A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Image Builder

CVE-2026-3864

CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server

A vulnerability was discovered in the Kubernetes CSI Driver for NFS where the subDir parameter in volume identifiers was insufficiently validated. Attackers with the ability to create PersistentVolumes referencing the NFS CSI driver could craft volume identifiers containing path traversal sequences (../). During volume deletion or cleanup operations, the driver could operate on unintended directories outside the intended managed path within the NFS export. This may lead to deletion or modification of directories on the NFS server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Csi Driver For Nfs

CVE-2025-57870

BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Esri Kubernetes Linux and 1 more

Products

Arcgis Server Kubernetes Linux and 2 more

CVE-2019-11253

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

CVSS 3.1 · 7.5 High EPSS 25.9% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Openshift Container Platform and 2 more

CVE-2021-25743

ANSI escape characters in kubectl output are not being filtered

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2024-9486

VM images built with Image Builder and Proxmox provider use default credentials

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Kubernetes Kubernetes-sigs

Products

Image Builder Image Builder

CVE-2024-9594

VM images built with Image Builder with some providers use default credentials during builds

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Kubernetes Kubernetes-sigs

Products

Image Builder Image Builder

CVE-2024-45310

runc can be confused to create empty files/directories on the host

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Docker Kubernetes Linux and 2 more

Products

Docker Kubernetes Linux Kernel and 2 more

CVE-2023-3893

Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Kubernetes

Products

Csi Proxy

CVE-2021-25736

Windows kube-proxy LoadBalancer contention

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Microsoft Redhat

Products

Kubernetes Windows Openshift

CVE-2023-5044

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

CVSS 3.1 · 7.6 High EPSS 53.7% KEV · Not listed

Vendors

Kubernetes

Products

Ingress-nginx

CVE-2022-2995

cri-o: incorrect handling of the supplementary groups

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Cri-o Openshift

CVE-2017-1002100

kubernetes: Incorrect default access permissions for Persistent Volumes

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

CVSS 3.0 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2017-1000056

kubernetes: Privilege escalation in the PodSecurityPolicy admission plugin

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Kubernetes

Products

Kubernetes

CVE-2015-7561

OpenShift3: Private Docker images can be used by any user, once they are pulled to a node

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.

CVSS 3.0 · 3.1 Low EPSS 1.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2016-1905

server: patch operation should use patched object to check admission control

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.

CVSS 3.0 · 7.7 High EPSS 1.6% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2016-1906

server: build config to a strategy that isn't allowed by policy

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

CVSS 3.0 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2015-7528

OpenShift: pod log location must validate container if provided

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2022-3162

Unauthorized read of Custom Resources

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift