Database/Container, Kubernetes & orchestration

Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policy

CVSS 6.5CVE-2021-25735Container, Kubernetes & orchestrationcurated

Impact

Node updates bypass a validating admission webhook, defeating node-level policy

Who can reach it

Cluster user able to update Node objects

What to do

Rolling control-plane upgrade; no GPU drain

References

https://nvd.nist.gov/vuln/detail/CVE-2021-25735

Related entries

Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images runCVE-2023-2727 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ServiceAccount mountable-secrets policyCVE-2023-2728 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Successful API requests can DoS the apiserverCVE-2020-8552 · Kubernetes (kube-apiserver)Medium

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.