Filtered by vendor Kubernetes Subscriptions
Total 97 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-25748 1 Kubernetes 1 Ingress-nginx 2025-01-17 7.6 High
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2021-25749 2 Kubernetes, Redhat 2 Kubernetes, Openshift 2025-01-17 7.8 High
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
CVE-2023-1174 2 Apple, Kubernetes 2 Macos, Minikube 2025-01-16 9.8 Critical
This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable unexpected remote access to the minikube container.
CVE-2023-1944 1 Kubernetes 1 Minikube 2025-01-16 8.4 High
This vulnerability enables ssh access to minikube container using a default password.
CVE-2024-31990 3 Argoproj, Kubernetes, Redhat 3 Argo Cd, Argo-cd, Openshift Gitops 2025-01-09 4.8 Medium
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The API server does not enforce project sourceNamespaces which allows attackers to use the UI to edit resources which should only be mutable via gitops. This vulenrability is fixed in 2.10.7, 2.9.12, and 2.8.16.
CVE-2023-5528 4 Fedoraproject, Kubernetes, Microsoft and 1 more 4 Fedora, Kubernetes, Windows and 1 more 2025-01-03 7.2 High
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVE-2024-5154 2 Kubernetes, Redhat 4 Cri-o, Enterprise Linux, Openshift and 1 more 2024-12-11 8.1 High
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
CVE-2024-10220 1 Kubernetes 1 Kubelet 2024-11-25 8.1 High
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
CVE-2023-1943 1 Kubernetes 2 Kops, Operations 2024-11-21 8 High
Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode.
CVE-2023-1260 2 Kubernetes, Redhat 4 Kube-apiserver, Openshift, Openshift Container Platform and 1 more 2024-11-21 8 High
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
CVE-2022-4318 3 Fedoraproject, Kubernetes, Redhat 9 Extra Packages For Enterprise Linux, Fedora, Cri-o and 6 more 2024-11-21 7.8 High
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
CVE-2022-3466 2 Kubernetes, Redhat 4 Cri-o, Openshift, Openshift Container Platform and 1 more 2024-11-21 4.8 Medium
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
CVE-2022-2995 2 Kubernetes, Redhat 2 Cri-o, Openshift 2024-11-21 7.1 High
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVE-2022-2385 1 Kubernetes 1 Aws-iam-authenticator 2024-11-21 8.1 High
A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
CVE-2022-27652 4 Fedoraproject, Kubernetes, Mobyproject and 1 more 5 Fedora, Cri-o, Moby and 2 more 2024-11-21 5.3 Medium
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
CVE-2022-1708 3 Fedoraproject, Kubernetes, Redhat 5 Fedora, Cri-o, Enterprise Linux and 2 more 2024-11-21 7.5 High
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
CVE-2022-0811 2 Kubernetes, Redhat 2 Cri-o, Openshift 2024-11-21 8.8 High
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
CVE-2022-0532 2 Kubernetes, Redhat 3 Cri-o, Openshift, Openshift Container Platform 2024-11-21 4.2 Medium
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
CVE-2021-25746 1 Kubernetes 1 Ingress-nginx 2024-11-21 7.6 High
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
CVE-2021-25745 1 Kubernetes 1 Ingress-nginx 2024-11-21 7.6 High
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.