Confused Deputy in Kubernetes

BASSO 3.1CVE-2021-25740 · GHSA-vw47-mr44-3jf9 · Published 20/09/2021 · updated 17/06/2026

In breve

CVE-2021-25740 è una vulnerabilità BASSO (CVSS 3.1) che riguarda k8s.io/kubernetes.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 80.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
k8s.io/kubernetes Go	`≤ 1.22.2`	No fix yet

Description

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

NVD description

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

References

nvd.nist.gov/vuln/detail/CVE-2021-25740 · ADVISORY
kubernetes/kubernetes · WEB
kubernetes/kubernetes · PACKAGE
groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE · WEB
kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves · WEB
security.netapp.com/advisory/ntap-20211014-0001 · WEB
kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
security.netapp.com/advisory/ntap-20211014-0001 · Third Party Advisory

Altre vulnerabilità di k8s.io/kubernetes

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

k8s.io/kubernetes

≤ 1.22.2

No fix yet

Description

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

NVD description

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

Altre vulnerabilità di k8s.io/kubernetes

Vedi tutto →