Kubernetes vulnerabilities

Products

• Kubernetes 64
• Ingress-nginx 22
• Cri-o 10
• Kubelet 7
• Ingress-nginx 4
• Image Builder 3
• Kube-apiserver 3
• Minikube 3
• Apiserver 2
• Image Builder 2
• Java 2
• Java Client 2
• Secrets Store Csi Driver 2
• Nginx Ingress Controller 2

Newest

• kubernetes ingress-nginx, suse rancher prime rke2 ingress-nginx +1 more ingress-nginx mirror-target self-DOS CVE-2026-116472 2.7 LowNovember 5, 2026
• kubernetes StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation CVE-2026-2270 Fix available 5.9 MediumOctober 26, 2026
• kubernetes Subpath symlinking on Windows nodes permits NTLM coercion CVE-2026-76654 5.8 MediumOctober 26, 2026
• kubernetes Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes CVE-2026-19444 Fix available 6.5 MediumSeptember 28, 2026
• kubernetes kubernetes-client/java Path traversal via non-tar copyDirectoryFromPod CVE-2026-15687 2.7 LowJuly 23, 2026
• kubernetes csi driver for nfs CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server CVE-2026-3864 Fix available 6.5 MediumMarch 20, 2026
• kubernetes ingress-nginx, nginx ingress controller +1 more ingress-nginx comment-based nginx configuration injection CVE-2026-4342 Public exploitFix available 8.8 HighMarch 19, 2026
• kubernetes ingress-nginx ingress-nginx rewrite-target nginx configuration injection CVE-2026-3288 Public exploit 8.8 HighMarch 9, 2026
• kubernetes ingress-nginx ingress-nginx auth-proxy-set-headers nginx configuration injection CVE-2025-15566 8.8 HighFebruary 6, 2026
• kubernetes ingress-nginx ingress-nginx Admission Controller denial of service CVE-2026-24514 Public exploitFix available 6.5 MediumFebruary 3, 2026
• kubernetes ingress-nginx ingress-nginx auth-url protection bypass CVE-2026-24513 Fix available 3.1 LowFebruary 3, 2026
• kubernetes ingress-nginx ingress-nginx auth-method nginx configuration injection CVE-2026-24512 Fix available 8.8 HighFebruary 3, 2026
• kubernetes ingress-nginx ingress-nginx auth-method nginx configuration injection CVE-2026-1580 Fix available 8.8 HighFebruary 3, 2026
• kubernetes Portworx Half-Blind SSRF in kube-controller-manager CVE-2025-13281 Fix available 5.8 MediumDecember 12, 2025
• kubernetes csharp client Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks CVE-2025-9708 Fix available 6.8 MediumSeptember 16, 2025
• kubernetes secrets-store-sync-controller Kubernetes secrets-store-sync-controller discloses service account tokens in logs CVE-2025-7445 Fix available 6.5 MediumSeptember 5, 2025
• kubernetes Nodes can delete themselves by adding an OwnerReference CVE-2025-5187 Fix available 6.7 MediumAugust 27, 2025
• kubernetes image builder VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override CVE-2025-7342 7.5 HighAugust 17, 2025
• kubernetes Nodes can bypass dynamic resource allocation authorization checks CVE-2025-4563 Fix available 2.7 LowJune 23, 2025
• kubernetes ingress-nginx ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVE-2025-24514 Public exploitFix available EPSS 37.3% 8.8 HighMarch 24, 2025
• kubernetes ingress-nginx ingress-nginx controller - auth secret file path traversal vulnerability CVE-2025-24513 Fix available 4.8 MediumMarch 24, 2025
• kubernetes ingress-nginx ingress-nginx controller - configuration injection via unsanitized mirror annotations CVE-2025-1098 Public exploitFix available EPSS 86.1% 8.8 HighMarch 24, 2025
• kubernetes ingress-nginx ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation CVE-2025-1097 Public exploitFix available EPSS 37.0% 8.8 HighMarch 24, 2025
• kubernetes ingress-nginx ingress-nginx admission controller RCE escalation CVE-2025-1974 Public exploitFix available EPSS 99.4% 9.8 CriticalMarch 24, 2025
• kubernetes kube-apiserver Network restriction bypass via race condition during namespace termination CVE-2024-7598 Fix available 3.1 LowMarch 20, 2025
• kubernetes kubelet Kubernetes GitRepo Volume Inadvertent Local Repository Access CVE-2025-1767 Fix available 6.5 MediumMarch 13, 2025
• kubernetes kubelet Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API CVE-2024-9042 Fix available 5.9 MediumMarch 13, 2025
• kubernetes kubelet Node Denial of Service via kubelet Checkpoint API CVE-2025-0426 Fix available 6.2 MediumFebruary 13, 2025
• kubernetes kubelet Arbitrary command execution through gitRepo volume CVE-2024-10220 Public exploitFix available 8.1 HighNovember 22, 2024
• devtron SQL Injection in CreateUser API in devtron CVE-2024-45794 Fix available 8.3 HighNovember 7, 2024
• kubernetes image builder VM images built with Image Builder with some providers use default credentials during builds CVE-2024-9594 Fix available 6.3 MediumOctober 15, 2024
• kubernetes image builder VM images built with Image Builder and Proxmox provider use default credentials CVE-2024-9486 Fix available 9.8 CriticalOctober 15, 2024
• kubernetes ingress-nginx A security issue was discovered in ingress-nginx where an actor with permission to create Ingress... CVE-2024-7646 Public exploit EPSS 27.0% 8.8 HighAugust 16, 2024
• kubernetes Incorrect permissions on Windows containers logs CVE-2024-5321 Fix available 6.1 MediumJuly 18, 2024
• kubernetes cri-o, red hat enterprise linux 8, enterprise linux 9 +8 more +10 more Cri-o: malicious container can create symlink on host CVE-2024-5154 Fix available 8.1 HighJune 4, 2024
• kubernetes azure-file-csi-driver Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs CVE-2024-3744 Fix available 6.5 MediumMay 15, 2024
• kubernetes Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin CVE-2024-3177 Public exploitFix available 2.7 LowApril 22, 2024
• argoproj argo cd, argo-cd +1 more Argo CD' API server does not enforce project sourceNamespaces CVE-2024-31990 Fix available 4.8 MediumApril 15, 2024
• kubernetes apiserver Rancher API Server Cross-site Scripting Vulnerability CVE-2023-32192 Fix available 8.3 HighFebruary 8, 2024
• kubernetes, fedoraproject fedora, kubernetes kubelet +2 more Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVE-2023-5528 Fix available 7.2 HighNovember 14, 2023
• kubernetes csi-proxy, csi proxy +1 more Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation CVE-2023-3893 Fix available 8.8 HighNovember 3, 2023
• kubernetes, kubernetes kubelet +1 more Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVE-2023-3955 Fix available 8.8 HighOctober 31, 2023
• kubernetes, kubernetes kubelet +1 more Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVE-2023-3676 Fix available EPSS 13.2% 8.8 HighOctober 31, 2023
• kubernetes Windows kube-proxy LoadBalancer contention CVE-2021-25736 Fix available 5.8 MediumOctober 30, 2023
• kubernetes ingress-nginx Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation CVE-2023-5044 Public exploitFix available EPSS 53.7% 7.6 HighOctober 25, 2023
• kubernetes ingress-nginx Ingress nginx annotation injection causes arbitrary command execution CVE-2023-5043 Public exploitFix available 7.6 HighOctober 25, 2023
• kubernetes ingress-nginx Ingress-nginx `path` sanitization can be bypassed with `log_format` directive CVE-2022-4886 Fix available 8.8 HighOctober 25, 2023
• kubernetes kops, operations +1 more Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode CVE-2023-1943 Fix available 8.0 HighOctober 11, 2023
• kubernetes kube-apiserver, red hat openshift container platform 4, openshift container platform 4.10 +5 more +7 more Kube-apiserver: privesc CVE-2023-1260 Fix available 8.0 HighSeptember 24, 2023
• kubernetes cri-o, redhat openshift container platform, red hat openshift container platform 3.11 +1 more +3 more Cri-o: security regression of cve-2022-27652 CVE-2022-3466 4.8 MediumSeptember 15, 2023
• Show olderLoading…