Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2022-3294

Node address isn't always verified when proxying

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

CVSS 3.1 · 6.6 Medium EPSS 1.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2023-3676

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS 3.1 · 8.8 High EPSS 13.2% KEV · Not listed
Vendors
Kubernetes Microsoft Redhat
Products
Kubernetes Windows Openshift
CVE-2023-5043

Ingress nginx annotation injection causes arbitrary command execution

Ingress nginx annotation injection causes arbitrary command execution.

CVSS 3.1 · 7.6 High EPSS 2.5% KEV · Not listed
Vendors
Kubernetes
Products
Ingress-nginx
CVE-2023-3955

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Kubernetes Microsoft Redhat
Products
Kubelet Kubernetes Windows and 1 more
CVE-2023-2878

Kubernetes secrets-store-csi-driver discloses service account tokens in logs

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kubernetes
Products
Secrets-store-csi-driver
CVE-2023-2728

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Openshift Ironic
CVE-2023-2727

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Openshift Ironic
CVE-2022-4886

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Kubernetes
Products
Ingress-nginx
CVE-2022-3172

Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

CVSS 3.1 · 5.1 Medium EPSS 2.5% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Apiserver Openshift Openshift Data Foundation
CVE-2023-2431

Bypass of seccomp profile enforcement

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kubernetes Redhat
Products
Fedora Kubernetes Openshift
CVE-2021-25748

Ingress-nginx `path` sanitization can be bypassed with newline character

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Kubernetes
Products
Ingress-nginx
CVE-2021-25749

runAsNonRoot logic bypass for Windows containers

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2023-1174

[minikube] Network Port exposure in minikube running on macOS using Docker driver

This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple Kubernetes
Products
Macos Minikube
CVE-2023-1944

[minikube] ssh server with default password

This vulnerability enables ssh access to minikube container using a default password.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Kubernetes
Products
Minikube
CVE-2024-31990

Argo CD' API server does not enforce project sourceNamespaces

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Argoproj Kubernetes Redhat
Products
Argo Cd Argo-cd Openshift Gitops
CVE-2023-1943

Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode

Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Kubernetes
Products
Kops Operations
CVE-2023-1260

Kube-apiserver: privesc

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.

CVSS 3.1 · 8 High EPSS 1.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kube-apiserver Openshift Openshift Container Platform and 1 more
CVE-2022-3466

Cri-o: security regression of cve-2022-27652

The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Cri-o Openshift Openshift Container Platform and 1 more
CVE-2022-2385

AccessKeyID validation bypass

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Kubernetes
Products
Aws-iam-authenticator