Confused Deputy in Kubernetes

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-25740 · ADVISORY
• kubernetes/kubernetes · WEB
• kubernetes/kubernetes · PACKAGE
• groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE · WEB
• kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves · WEB
• security.netapp.com/advisory/ntap-20211014-0001 · WEB
• kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
• security.netapp.com/advisory/ntap-20211014-0001 · Third Party Advisory

Weitere Schwachstellen in k8s.io/kubernetes

• CVE-2025-13281MITTEL 5.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass…
• CVE-2025-5187MITTEL 6.7A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding no…
• CVE-2025-4563NIEDRIG 2.7A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. …
• CVE-2024-7598NIEDRIG 3.1A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network pol…
• CVE-2025-1767MITTEL 6.5This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same …