Kubernetes: kubelet subPath symlink to a UNC path coerces NTLM authentication on Windows nodes

Impact

On Windows nodes the kubelet resolves a pod's volumeMounts subPath without rejecting targets that resolve to a UNC path, so a symlink pointing at an attacker-controlled SMB share makes the kubelet authenticate to that share with NTLM. The attacker captures the NetNTLMv2 hash of the kubelet's service account and can crack it offline or relay it to impersonate the node - on a domain-joined node that is a machine identity in the Windows domain, not just a cluster credential. Requires the ability to create a pod with a crafted subPath, so it is a privilege-escalation path for an existing workload author rather than an outside attack. Linux nodes are not affected, which means most GPU fleets are out of scope; mixed clusters with Windows worker pools are not.

Who can reach it

A user who can schedule a pod with attacker-chosen volumeMounts onto a Windows node, and who controls (or can reach) an SMB share the node can connect to. Authenticated cluster access required.

What to do

Apply the kubelet patches announced on kubernetes-security-announce for your release branch and restart the kubelet on each Windows node. Where patching has to wait, block pod specs that use subPath on Windows nodes via admission control and egress-filter SMB (445) from node to untrusted networks.

References

Related entries

• containerd: Goroutine leak in the CRI stream server terminal-resize path exhausts host memoryCVE-2022-23471 · containerdMedium
• Argo Workflows (controller, daemon workflow SPDY client race): A data race in a global variable in the Kubernetes SPDYCVE-2024-47827 · Argo Workflows (controller, daemon workflow SPDY client race)Medium
• CRI-O: oversized /etc/passwd in a tenant image exhausts node memory when runAsUser is unknownCVE-2025-4437 · CRI-O (runAsUser resolution reads the container /etc/passwd into memory)Medium
• Docker Sandboxes: read-only host mounts stay writable at their virtio-fs shared-export pathCVE-2026-18171 · Docker Sandboxes (virtio-fs host-edge grant for read-only mounts)Medium
• Skipper routesrv: cluster-wide route and Redis/Valkey shard data served with no authenticationCVE-2026-54246 · Zalando Skipper routesrv (/routes and /swarm/*/shards endpoints)Medium
• Capsule: webhook rule typo lets a tenant user retag a namespace and cross tenant boundariesCVE-2026-55636 · Capsule (Kubernetes multi-tenancy) validating webhook rule for namespaces/finalizeMedium