DEBIAN-CVE-2026-2270
DEBIAN-CVE-2026-2270
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht Aktualisiert
PatchFirst · Aktuelle Sicherheitslücken
Sicherheitslücken in kubernetes
In den letzten 30 Tagen veröffentlichte Sicherheitslücken für kubernetes: 1. Davon im KEV-Katalog: 0.
Sicherheitslücken: 50
Portworx Half-Blind SSRF in kube-controller-manager
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertNodes can delete themselves by adding an OwnerReference
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertNodes can bypass dynamic resource allocation authorization checks
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertNetwork restriction bypass via race condition during namespace termination
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertCVE-2025-1767
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertCVE-2025-0426
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertArbitrary command execution through gitRepo volume
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertBypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field pop
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertKubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertKubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertBypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertBypassing policies imposed by the ImagePolicyWebhook admission plugin
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertBypass of seccomp profile enforcement
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertNode address isn't always verified when proxying
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertUnauthorized read of Custom Resources
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertBypass of Kubernetes API Server proxy TOCTOU
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction
- Auf 1.20.5+really1.20.2-1 aktualisieren
Veröffentlicht AktualisiertANSI escape characters in kubectl output are not being filtered
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- Auf 1.31.4+ds-1 aktualisieren
Veröffentlicht Aktualisiert
Prüfen Sie Ihren Server
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.