Description
A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | unspecified – ≤ 1.19.14, unspecified – ≤ 1.20.10, unspecified – ≤ 1.21.4, unspecified – ≤ 1.22.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +1 | 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el7 | RHSA-2021:3642, RHSA-2021:3635, RHSA-2021:3631 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.524-1.git.0.2dffce7.el7 | RHSA-2021:3646 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | istio +1 | 1.10.4-3.el8 | ELSA-2021-9546 |
| Oracle Linux 8 | kubeadm +2 | 1.20.11-4.el8 | ELSA-2021-9546 |
| Oracle Linux 8 | olcnectl +8 | 1.3.2-2.el8 | ELSA-2021-9546 |
| Oracle Linux 7 | istio +1 | 1.10.4-3.el7 | ELSA-2021-9526 |
| Oracle Linux 7 | kubeadm +2 | 1.20.11-4.el7 | ELSA-2021-9526 |
| Oracle Linux 7 | olcnectl +8 | 1.3.2-2.el7 | ELSA-2021-9526 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
Betep0k/CVE-2021-25741 ★ 30 · Jan 19, 2022
Exploit for CVE-2021-25741 vulnerability
-
Glutenfree69/ZigRaceExploit ★ 0 · Mar 17, 2026
CVE-2021-25741 POC in Zig
-
cdxiaodong/CVE-2021-25741 ★ 0 · Oct 19, 2023
fork on Betep0k/CVE-2021-25741/fork whose images is useless and test on metarget
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | < 1.19.15 | 1.19.15 | GHSA-f5f7-6478-qm6p |
| Go | k8s.io/kubernetes | >= 1.20.0, < 1.20.11 | 1.20.11 | GHSA-f5f7-6478-qm6p |
| Go | k8s.io/kubernetes | >= 1.21.0, < 1.21.5 | 1.21.5 | GHSA-f5f7-6478-qm6p |
| Go | k8s.io/kubernetes | >= 1.22.0, < 1.22.2 | 1.22.2 | GHSA-f5f7-6478-qm6p |
| Go | k8s.io/kubernetes | < 1.19.15 · >= 1.20.0, < 1.20.11 · >= 1.21.0, < 1.21.5 · >= 1.22.0, < 1.22.2 | 1.19.15, 1.20.11, 1.21.5, 1.22.2 | GO-2022-0910 |
Advisories 9
- WID-SEC-2026-2596 Kubernetes: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 30, 2026
- RHSA-2021:3646 Red Hat Security Advisory: OpenShift Container Platform 3.11.524 security and bug fix update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2021:3642 Red Hat Security Advisory: OpenShift Container Platform 4.6.46 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2021:3635 Red Hat Security Advisory: OpenShift Container Platform 4.7.32 packages and security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2021:3631 Red Hat Security Advisory: OpenShift Container Platform 4.8.13 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ELSA-2021-9546 Important: olcne istio istio kubernetes security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2021
- ELSA-2021-9526 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2021