Kubernetes (kube-apiserver): NetworkPolicy is not applied during a race in namespace termination, so pods briefly run

Impact

NetworkPolicy is not applied during a race in namespace termination, so pods briefly run unrestricted

Who can reach it

Cluster user who can create and delete namespaces

What to do

Rolling control-plane upgrade; treat namespace churn as a policy-gap window

References

Related entries

• Kubernetes (kube-apiserver): Init/ephemeral container envFrom bypasses the ServiceAccount mountable-secrets policyCVE-2024-3177 · Kubernetes (kube-apiserver)Low
• Kubernetes (kube-apiserver): Nodes can bypass DRA authorization checksCVE-2025-4563 · Kubernetes (kube-apiserver)Low
• Kubernetes (kube-apiserver): TOCTOU/DNS-rebinding bypass of the link-local and localhost proxy protectionsCVE-2020-8562 · Kubernetes (kube-apiserver)Low
• Kubernetes (kube-apiserver): Cluster-scoped custom resources reachable through namespaced requests, so namespace-scopedCVE-2019-11247 · Kubernetes (kube-apiserver)High
• Kubernetes (kube-apiserver): "Billion laughs": malicious YAML/JSON payload consumes all apiserver memoryCVE-2019-11253 · Kubernetes (kube-apiserver)High
• Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium