Skip to content
OpenAdvisories

Package · Go

k8s.io/kubernetes

50 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.1
    CVE-2024-10220 Public exploit

    Arbitrary command execution through gitRepo volume

    The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

    Kubernetes Kubelet kubeflow-pipelines-apiserver kubeflow-pipelines-frontend Debian Azure Linux Wolfi Go
  • High 7.7
    CVE-2024-0793

    Kube-controller-manager: malformed hpa v1 manifest causes crash

    A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

    Red Hat Red Hat OpenShift Container Platform 4 Red Hat OpenShift Container Platform 4.12 argocd-image-updater Wolfi Go
  • High 7.2
    CVE-2023-5528

    Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

    A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plug…

    Kubernetes Kubelet prometheus-adapter spark-operator Azure Linux Wolfi Go
  • High 8.8
    CVE-2023-3955

    Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

    Kubernetes Kubelet kubeflow-pipelines-apiserver aws-efs-csi-driver Debian Wolfi Go
  • High 8.8
    CVE-2023-3676 EPSS 13%

    Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

    A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

    Kubernetes Kubelet k8s.io/kubernetes kubernetes Debian Go
  • High 8.8
    CVE-2021-25741 Public exploit

    Symlink Exchange Can Allow Host Filesystem Access

    A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go
  • High 7.5
    CVE-2019-11253 Scanner template EPSS 26%

    Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memo…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • High 7.1
    CVE-2017-1002102

    Kubernetes arbitrary file overwrite

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go