Kubernetes (kube-apiserver): Cluster-scoped custom resources reachable through namespaced requests, so namespace-scoped

Impact

Cluster-scoped custom resources reachable through namespaced requests, so namespace-scoped RBAC grants cluster-wide CR access

Who can reach it

Cluster user with namespace access

What to do

Rolling control-plane upgrade; no GPU drain. Audit CRD RBAC afterwards

References

Related entries

• Kubernetes (kube-apiserver): "Billion laughs": malicious YAML/JSON payload consumes all apiserver memoryCVE-2019-11253 · Kubernetes (kube-apiserver)High
• Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
• Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
• Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
• Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policyCVE-2021-25735 · Kubernetes (kube-apiserver)Medium
• Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium