Skip to content
OpenAdvisories

Package · Go

github.com/k3s-io/k3s

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.8
    CVE-2026-54250

    K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

    K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with malicious…

    k3s-io k3s github.com/k3s-io/k3s Go
  • Medium 6.8
    CVE-2025-46599

    CNCF K3s Kubernetes kubelet configuration exposes credentials

    CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticat…

    K3s K3s github.com/k3s-io/k3s Go