{"kind": "product", "path": "vulns/debian-14/kubernetes", "name": "kubernetes", "product": "kubernetes", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-2270", "noindex": false, "published": "2026-09-24T09:47:33.699256055Z", "modified": "2026-09-24T10:00:08.327639765Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-2270", "title": "DEBIAN-CVE-2026-2270", "description": "DEBIAN-CVE-2026-2270", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-2270", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-2270"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-13281", "noindex": false, "published": "2025-12-14T21:27:34.786Z", "modified": "2025-12-15T16:26:59.485Z", "cvss": 5.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00389, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-13281", "title": "Portworx Half-Blind SSRF in kube-controller-manager", "description": "A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).", "references": ["https://github.com/kubernetes/kubernetes/issues/135525", "https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ", "http://www.openwall.com/lists/oss-security/2025/12/01/4"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-5187", "noindex": false, "published": "2025-08-27T16:20:56.778Z", "modified": "2026-02-26T17:47:59.242Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "severity": "medium", "epss": 0.00574, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-5187", "title": "Nodes can delete themselves by adding an OwnerReference", "description": "A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.", "references": ["https://github.com/kubernetes/kubernetes/issues/133471", "https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE", "https://nvd.nist.gov/vuln/detail/CVE-2025-5187"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-4563", "noindex": false, "published": "2025-06-23T15:38:42.258Z", "modified": "2025-06-23T15:58:05.106Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00827, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-4563", "title": "Nodes can bypass dynamic resource allocation authorization checks", "description": "A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ", "https://github.com/kubernetes/kubernetes/issues/132151", "https://nvd.nist.gov/vuln/detail/CVE-2025-4563"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-7598", "noindex": false, "published": "2025-03-20T16:52:57.929Z", "modified": "2025-03-20T21:02:37.374Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.0032, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2024-7598", "title": "Network restriction bypass via race condition during namespace termination", "description": "A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.", "references": ["https://github.com/kubernetes/kubernetes/issues/126587", "https://groups.google.com/g/kubernetes-security-announce/c/67D7UFqiPRc", "http://www.openwall.com/lists/oss-security/2025/03/20/2"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-1767", "noindex": false, "published": "2025-03-13T16:40:42.663Z", "modified": "2025-03-17T16:59:37.276Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00703, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-1767", "title": "CVE-2025-1767", "description": "This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.", "references": ["https://github.com/kubernetes/kubernetes/pull/130786", "https://groups.google.com/g/kubernetes-security-announce/c/19irihsKg7s", "http://www.openwall.com/lists/oss-security/2025/03/13/9"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-0426", "noindex": false, "published": "2025-02-13T15:16:13.703Z", "modified": "2025-02-13T17:02:37.167Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-0426", "title": "CVE-2025-0426", "description": "A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.", "references": ["https://github.com/kubernetes/kubernetes/issues/130016", "https://groups.google.com/g/kubernetes-security-announce/c/KiODfu8i6w8", "http://www.openwall.com/lists/oss-security/2025/02/13/1"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-10220", "noindex": false, "published": "2024-11-22T16:23:00.535Z", "modified": "2024-11-25T18:22:59.457Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.03027, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2024-10220", "title": "Arbitrary command execution through gitRepo volume", "description": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.", "references": ["https://github.com/kubernetes/kubernetes/issues/128885", "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko", "http://www.openwall.com/lists/oss-security/2024/11/20/1"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-3177", "noindex": false, "published": "2024-04-22T23:00:39.702Z", "modified": "2024-09-10T20:48:09.780Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.02224, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2024-3177", "title": "Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin", "description": "A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field pop", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ", "https://github.com/kubernetes/kubernetes/issues/124336", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-3172", "noindex": false, "published": "2023-11-03T18:11:53.835Z", "modified": "2025-02-13T16:32:41.378Z", "cvss": 5.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "severity": "medium", "epss": 0.02464, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-3172", "title": "Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)", "description": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client's API server credentials to third parties.", "references": ["https://github.com/kubernetes/kubernetes/issues/112513", "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak", "https://security.netapp.com/advisory/ntap-20231221-0005/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-3893", "noindex": false, "published": "2023-11-03T17:34:10.188Z", "modified": "2025-02-13T17:02:36.473Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.02475, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-3893", "title": "Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation", "description": "A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.", "references": ["https://github.com/kubernetes/kubernetes/issues/119594", "https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ", "https://security.netapp.com/advisory/ntap-20231221-0004/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-3955", "noindex": false, "published": "2023-10-31T20:36:54.352Z", "modified": "2025-02-13T17:03:13.470Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.03998, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-3955", "title": "Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation", "description": "A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.", "references": ["https://github.com/kubernetes/kubernetes/issues/119595", "https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E", "https://security.netapp.com/advisory/ntap-20231221-0002/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-3676", "noindex": false, "published": "2023-10-31T20:22:53.620Z", "modified": "2025-02-27T20:38:37.768Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.13156, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-3676", "title": "Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation", "description": "A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.", "references": ["https://github.com/kubernetes/kubernetes/issues/119339", "https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc", "https://security.netapp.com/advisory/ntap-20231130-0007/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-2728", "noindex": false, "published": "2023-07-03T20:06:11.796Z", "modified": "2025-02-13T16:45:20.353Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.02157, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-2728", "title": "Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin", "description": "Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8", "https://github.com/kubernetes/kubernetes/issues/118640", "http://www.openwall.com/lists/oss-security/2023/07/06/3"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-2727", "noindex": false, "published": "2023-07-03T20:05:04.329Z", "modified": "2025-02-13T16:45:04.559Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.01134, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-2727", "title": "Bypassing policies imposed by the ImagePolicyWebhook admission plugin", "description": "Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8", "https://github.com/kubernetes/kubernetes/issues/118640", "http://www.openwall.com/lists/oss-security/2023/07/06/2"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-2431", "noindex": false, "published": "2023-06-16T07:08:33.476Z", "modified": "2025-02-13T16:44:13.942Z", "cvss": 3.4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00257, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-2431", "title": "Bypass of seccomp profile enforcement", "description": "A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10", "https://github.com/kubernetes/kubernetes/issues/118690", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-3294", "noindex": false, "published": "2023-03-01T00:00:00.000Z", "modified": "2025-03-07T18:34:22.358Z", "cvss": 6.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.01618, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-3294", "title": "Node address isn't always verified when proxying", "description": "Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA", "https://github.com/kubernetes/kubernetes/issues/113757", "https://security.netapp.com/advisory/ntap-20230505-0007/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-3162", "noindex": false, "published": "2023-03-01T00:00:00.000Z", "modified": "2025-03-07T18:35:03.127Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.01191, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-3162", "title": "Unauthorized read of Custom Resources", "description": "Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.", "references": ["https://groups.google.com/g/kubernetes-security-announce/c/iUd550j7kjA", "https://github.com/kubernetes/kubernetes/issues/113756", "https://security.netapp.com/advisory/ntap-20230511-0004/"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2020-8562", "noindex": false, "published": "2022-02-01T10:33:00.317Z", "modified": "2026-06-01T21:45:40.339Z", "cvss": 2.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.01082, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2020-8562", "title": "Bypass of Kubernetes API Server proxy TOCTOU", "description": "As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction ", "references": ["https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/", "https://github.com/kubernetes/kubernetes/issues/101493", "https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY"], "fixes": ["1.20.5+really1.20.2-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-25743", "noindex": false, "published": "2022-01-07T00:00:12.399Z", "modified": "2024-09-16T23:51:24.348Z", "cvss": 3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N", "severity": "low", "epss": 0.00785, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-25743", "title": "ANSI escape characters in kubectl output are not being filtered", "description": "kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.", "references": ["https://github.com/kubernetes/kubernetes/issues/101695", "https://security.netapp.com/advisory/ntap-20220217-0003/", "https://nvd.nist.gov/vuln/detail/CVE-2021-25743"], "fixes": ["1.31.4+ds-1"], "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}]}], "total": 50, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "kubernetes", "path": "vulns/debian-14/kubernetes", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-24T10:00:08.327639765Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}