Skip to content
OpenAdvisories

Package · Go

github.com/k3s-io/k3s

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.8
    CVE-2026-54250

    K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

    K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with malicious…

    k3s-io k3s github.com/k3s-io/k3s Go
  • Medium 6.8
    CVE-2025-46599

    CNCF K3s Kubernetes kubelet configuration exposes credentials

    CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticat…

    K3s K3s github.com/k3s-io/k3s Go
  • High 7.5
    CVE-2023-32187

    K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack

    An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.…

    SUSE k3s k3s github.com/k3s-io/k3s Alpine Go