Description
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | unspecified – ≤ v1.25.3, unspecified – ≤ v1.24.7, unspecified – ≤ v1.23.13, unspecified – ≤ v1.22.15 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | microshift | 4.12.1-202301261525.p0.g3db9e81.assembly.4.12.1.el8 | RHBA-2023:0452 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | kubernetes1.23 | 1.23.17-150300.7.6.1 | SUSE-SU-2023:2292-1 |
| SLES 15 SP3 | kubernetes1.23 | 1.23.17-150300.7.6.1 | SUSE-SU-2023:2292-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | kubernetes1.23 | 1.23.17-150300.7.6.1 | SUSE-SU-2023:2292-1 |
| SLE HPC 15 SP3 | kubernetes1.23 | 1.23.17-150300.7.6.1 | SUSE-SU-2023:2292-1 |
| SUSE Enterprise Storage 7.1 | kubernetes1.23 | 1.23.17-150300.7.6.1 | SUSE-SU-2023:2292-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
| openSUSE Tumbleweed | kubernetes1.25 | 1.25.7-1.1 | openSUSE-SU-2024:12810-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | kubeadm +2 | 1.21.14-3.el8 | ELSA-2022-10036, ELSA-2022-10034 |
| Oracle Linux 8 | olcne-metallb-chart +1 | 1.5.8-4.el8 | ELSA-2022-10036 |
| Oracle Linux 8 | olcnectl +10 | 1.4.9-2.el8 | ELSA-2022-10036, ELSA-2022-10034 |
| Oracle Linux 7 | kubeadm +2 | 1.21.14-3.el7 | ELSA-2022-10035, ELSA-2022-10033 |
| Oracle Linux 7 | olcne-metallb-chart +1 | 1.5.8-4.el7 | ELSA-2022-10035 |
| Oracle Linux 7 | olcnectl +10 | 1.4.9-2.el7 | ELSA-2022-10035, ELSA-2022-10033 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
arbaaz29/CVE-2022-3294 ★ 0 · Jan 14, 2026
Privilege Escalation using nodes/proxy (create action allowed) and nodes/status (update/patch actions allowed)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kubernetes/kubernetes | >= 1.25.0, < 1.25.4 | 1.25.4 | GHSA-jh36-q97c-9928 |
| Go | github.com/kubernetes/kubernetes | >= 1.24.0, < 1.24.8 | 1.24.8 | GHSA-jh36-q97c-9928 |
| Go | github.com/kubernetes/kubernetes | >= 1.23.0, < 1.23.14 | 1.23.14 | GHSA-jh36-q97c-9928 |
| Go | github.com/kubernetes/kubernetes | >= 1.22.0, < 1.22.16 | 1.22.16 | GHSA-jh36-q97c-9928 |
| Go | k8s.io/kubernetes | >= 1.22.0, < 1.22.16 · >= 1.23.0, < 1.23.14 · >= 1.24.0, < 1.24.8 · >= 1.25.0, < 1.25.4 | 1.22.16, 1.23.14, 1.24.8, 1.25.4 | GO-2023-1629 |
Advisories 11
- RHBA-2023:0452 Red Hat Bug Fix Advisory: rpm Red Hat Security Advisories (RHSA) · Aug 14, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:12810-1 kubernetes1.25-apiserver-1.25.7-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2292-1 Security update for kubernetes1.23 SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- WID-SEC-2023-0549 Kubernetes: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 4, 2023
- ELSA-2022-10034 Important: kubernetes security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022
- ELSA-2022-10036 Important: kubernetes security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022
- ELSA-2022-10035 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022
- ELSA-2022-10033 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 29, 2022