Skip to content
OpenAdvisories

Vendor

Kubernetes

107 known vulnerabilities.

Products

Kubernetes 54 ingress-nginx 18 Kubelet 7 Kubernetes ingress-nginx 4 Minikube 3 Image Builder 3 Kubernetes Java Client 2 Kubernetes Secrets Store CSI Driver 2 kube-apiserver 2 kubernetes-client/java 1 azure-file-csi-driver 1 k8s.gcr.io/defaultbackend 1 kubernetes-csi external-provisioner 1 kubernetes-csi external-snapshotter 1 kubernetes-csi external-resizer 1 aws-iam-authenticator 1 kops 1 secrets-store-csi-driver 1 Kubernetes CSharp Client 1 CSI Driver for NFS 1 csi-proxy 1 secrets-store-sync-controller 1 CSI Snapshotter 1
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.8
    CVE-2026-4342 Public exploit

    ingress-nginx comment-based nginx configuration injection

    A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets acc…

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 8.8
    CVE-2026-3288 Public exploit

    ingress-nginx rewrite-target nginx configuration injection

    A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/rewrite-target` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller…

    Kubernetes ingress-nginx
  • High 8.8
    CVE-2025-24514 Public exploit EPSS 37%

    ingress-nginx controller - configuration injection via unsanitized auth-url annotation

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx …

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 8.8
    CVE-2025-1098 Public exploit EPSS 86%

    ingress-nginx controller - configuration injection via unsanitized mirror annotations

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in…

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 8.8
    CVE-2025-1097 Public exploit EPSS 37%

    ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

    A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingre…

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 8.1
    CVE-2024-10220 Public exploit

    Arbitrary command execution through gitRepo volume

    The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

    Kubernetes Kubelet k8s.io/kubernetes kubernetes Debian Go
  • High 8.8
    CVE-2024-7646 Public exploit EPSS 27%

    CVE-2024-7646 in github.com/kubernetes/ingress-nginx

    A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the in…

    Kubernetes ingress-nginx github.com/kubernetes/ingress-nginx Go
  • High 7.6
    CVE-2023-5044 Public exploit EPSS 54%

    Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

    Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 7.6
    CVE-2023-5043 Public exploit

    Ingress nginx annotation injection causes arbitrary command execution

    Ingress nginx annotation injection causes arbitrary command execution.

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • High 8.8
    CVE-2021-25741 Public exploit

    Symlink Exchange Can Allow Host Filesystem Access

    A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Go
  • High 7.5
    CVE-2020-8570 Public exploit

    Kubernetes Java client libraries unvalidated path traversal in Copy implementation

    Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any f…

    Kubernetes Kubernetes Java Client io.kubernetes:client-java Maven
  • High 8.8
    CVE-2017-1002101 Public exploit EPSS 13%

    In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpat…

    Kubernetes Kubernetes kubernetes Debian