Database/Container, Kubernetes & orchestration

Container and Kubernetes vulnerabilities for GPU clusters

Container escapes, Kubernetes privilege escalation, and scheduler and service mesh flaws: Docker, containerd, runc, kubelet, Argo, Istio, and the isolation boundary every multi-tenant GPU cluster depends on.

588 entries72 critical3 known exploitedFilter and search this layer

2026226

202565

202351

202468

202260

202035

Rancher: Incorrectly applied authorization check lets a namespace be moved into a different projectHighDec 12, 2023
Kubernetes (kube-apiserver): TOCTOU/DNS-rebinding bypass of the link-local and localhost proxy protectionsLowFeb 1, 2022
Kubernetes (kube-apiserver): Admission webhook responses redirect apiserver requests into private networksMediumSep 20, 2021
Harbor: Catalog registry API exposed on an unauthenticated pathMediumFeb 2, 2021
Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterMediumJan 21, 2021
Kubernetes (cloud-controller-manager): vSphere cloud credentials leaked into logs at verbosity 4+MediumDec 7, 2020
Kubernetes: Malformed docker config leaks registry pull secrets into logsMediumDec 7, 2020
Kubernetes: Authorization and bearer tokens written to logs at verbosity 9MediumDec 7, 2020
Kubernetes (kube-controller-manager): Ceph RBD admin secrets written to controller-manager logsMediumDec 7, 2020
containerd: containerd-shim abstract-socket API exposed to host-network containersMediumDec 1, 2020
Slurm: RPC buffer overflow in the PMIx MPI pluginCriticalNov 27, 2020
Firecracker: Unbounded serial console buffer growth leaks host memoryHighOct 16, 2020
containerd: "ContainerDrip": registry credentials leaked to an attacker-controlled URL referenced in an image manifestMediumOct 16, 2020
Istio: DENY AuthorizationPolicy with wildcard-suffix principals silently fails to denyMediumOct 1, 2020
etcd: Gateway can be pointed at itself, causing an infinite loop and control-plane DoSHighAug 6, 2020
etcd: Gateway TLS authentication applied only to endpoints found in DNS SRV recordsMediumAug 6, 2020
etcd: No password length validation permits one-character etcd passwordsMediumAug 6, 2020
Firecracker: Network stack freezes under heavy ingressMediumAug 4, 2020
ingress-nginx: A tenant can overwrite another ingress's basic-auth password fileMediumJul 29, 2020
Kubernetes (kubelet/kube-proxy): Node's 127.0.0.1-bound services reachable from adjacent hosts and podsMediumJul 27, 2020
Kubernetes (kubelet): Pod writes to its own /etc/hosts unaccounted for in evictionMediumJul 23, 2020
Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherMediumJul 22, 2020
Harbor: SSRF: a user who can edit projects scans the Harbor host's intranetMediumJul 15, 2020
Kubernetes (kube-controller-manager): Half-blind SSRF from the controller manager into the cloud metadata serviceMediumJun 5, 2020
Slurm: Race condition in message aggregation allows launching a process as another userHighMay 21, 2020
Helm: The `lookup` template function discloses in-cluster resources, including Secrets, to a chart authorHighApr 24, 2020
Kubernetes (kube-apiserver): Successful API requests can DoS the apiserverMediumMar 27, 2020
Kubernetes (kubelet): Kubelet API DoS, including via the unauthenticated read-only portMediumMar 27, 2020
Envoy: HTTP/1.1 requests or responses with many 1-byte chunks exhaust proxy memoryHighMar 4, 2020
Envoy: generating internal responses to pipelined HTTP/1.1 requests consumes excessive memoryHighMar 4, 2020
Envoy: static validation context silently dropped when a shared SDS secret is used, weakening peer checksMediumMar 4, 2020
Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP pathsHighFeb 12, 2020
etcd gateway (--discovery-srv secure endpoint validation): TLS VALIDATION THAT VALIDATES NOTHING: the etcd gateway'sMedium2020
runc (linux.resources.devices cgroup list handling): MULTI-TENANT DEVICE ISOLATION: runc implemented theMedium2020
etcd (write-ahead log, user authentication entries): CONTROL-PLANE CREDENTIALS AT REST IN CLEARTEXT: etcd writes theMedium2020

202151

201929

20183