Update module k8s.io/kubernetes to v1.32.10 [SECURITY] (release-v0.19)

[redhat-renovate-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
k8s.io/kubernetes	require	minor	v1.15.0-alpha.0 → v1.32.10

---

Server Side Request Forgery (SSRF) in Kubernetes

CVE-2020-8555 / GHSA-x6mj-w4jf-jmgw / GO-2022-0890

More information

Details

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8555
• https://github.com/kubernetes/kubernetes/issues/91542
• https://github.com/kubernetes/kubernetes/pull/89794
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX
• https://security.netapp.com/advisory/ntap-20200724-0005
• http://www.openwall.com/lists/oss-security/2020/06/01/4
• http://www.openwall.com/lists/oss-security/2021/05/04/8

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes

CVE-2020-8555 / GHSA-x6mj-w4jf-jmgw / GO-2022-0890

More information

Details

Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-x6mj-w4jf-jmgw
• http://www.openwall.com/lists/oss-security/2020/06/01/4
• http://www.openwall.com/lists/oss-security/2021/05/04/8
• https://github.com/kubernetes/kubernetes/issues/91542
• https://github.com/kubernetes/kubernetes/pull/89794
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX
• https://security.netapp.com/advisory/ntap-20200724-0005

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes client-go library logs may disclose credentials to unauthorized users

CVE-2019-11250 / GHSA-jmrx-5g74-6v2f / GO-2021-0065

More information

Details

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-11250
• https://github.com/kubernetes/kubernetes/issues/81114
• https://github.com/kubernetes/kubernetes/pull/81330
• https://github.com/kubernetes/kubernetes/commit/4441f1d9c3e94d9a3d93b4f184a591cab02a5245
• https://access.redhat.com/errata/RHSA-2019:4052
• https://access.redhat.com/errata/RHSA-2019:4087
• https://github.com/kubernetes/kubernetes
• https://pkg.go.dev/vuln/GO-2021-0065
• https://security.netapp.com/advisory/ntap-20190919-0003
• http://www.openwall.com/lists/oss-security/2020/10/16/2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Improper Authentication in Kubernetes

CVE-2020-8558 / GHSA-wqv3-8cm6-h6wg / GO-2022-0885

More information

Details

A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-wqv3-8cm6-h6wg
• https://nvd.nist.gov/vuln/detail/CVE-2020-8558
• https://github.com/kubernetes/kubernetes/issues/92315
• https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
• https://github.com/kubernetes/kubernetes
• https://github.com/tabbysable/POC-2020-8558
• https://groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJ
• https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
• https://security.netapp.com/advisory/ntap-20200821-0001
• https://www.openwall.com/lists/oss-security/2020/07/08/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Improper Authentication in Kubernetes in k8s.io/kubernetes

CVE-2020-8558 / GHSA-wqv3-8cm6-h6wg / GO-2022-0885

More information

Details

Improper Authentication in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-wqv3-8cm6-h6wg
• https://bugzilla.redhat.com/show_bug.cgi?id=1843358
• https://github.com/kubernetes/kubernetes/issues/92315
• https://github.com/tabbysable/POC-2020-8558
• https://groups.google.com/g/kubernetes-announce/c/sI4KmlH3S2I/m/TljjxOBvBQAJ
• https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
• https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
• https://security.netapp.com/advisory/ntap-20200821-0001
• https://www.openwall.com/lists/oss-security/2020/07/08/1

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Privilege Escalation in Kubernetes

CVE-2020-8559 / GHSA-33c5-9fx5-fvjm / GO-2024-2748

More information

Details

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8559
• https://github.com/kubernetes/kubernetes/issues/92914
• https://github.com/kubernetes/kubernetes/pull/92941
• https://bugzilla.redhat.com/show_bug.cgi?id=1851422
• https://github.com/kubernetes/kubernetes
• https://github.com/tdwyer/CVE-2020-8559
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
• https://security.netapp.com/advisory/ntap-20200810-0004

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Privilege Escalation in Kubernetes in k8s.io/apimachinery

CVE-2020-8559 / GHSA-33c5-9fx5-fvjm / GO-2024-2748

More information

Details

The Kubernetes kube-apiserver is vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Severity

Unknown

References

• https://github.com/advisories/GHSA-33c5-9fx5-fvjm
• https://bugzilla.redhat.com/show_bug.cgi?id=1851422
• https://github.com/kubernetes/kubernetes/issues/92914
• https://github.com/kubernetes/kubernetes/pull/92941
• https://github.com/tdwyer/CVE-2020-8559
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs
• https://security.netapp.com/advisory/ntap-20200810-0004

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Denial of service in Kubernetes in k8s.io/kubernetes

CVE-2020-8557 / GHSA-55qj-gj3x-jq9r / GO-2024-2753

More information

Details

Denial of service in Kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-55qj-gj3x-jq9r
• https://github.com/kubernetes/kubernetes/commit/530f199b6e07cdaab32361e39709ac45f3fdc446
• https://github.com/kubernetes/kubernetes/commit/68750fefd3df76b7b008ef7b18e8acd18d5c2f2e
• https://github.com/kubernetes/kubernetes/commit/7fd849cffa2f93061fbcb0a6ae4efd0539b1e981
• https://github.com/kubernetes/kubernetes/issues/93032
• https://github.com/kubernetes/kubernetes/pull/92921
• https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ
• https://security.netapp.com/advisory/ntap-20200821-0002

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

CVE-2020-8566 / GHSA-5x96-j797-5qqw / GO-2024-2754

More information

Details

Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-5x96-j797-5qqw
• https://bugzilla.redhat.com/show_bug.cgi?id=1886640
• https://github.com/kubernetes/kubernetes/issues/95624
• https://github.com/kubernetes/kubernetes/pull/95245
• https://github.com/kubernetes/kubernetes/pull/95245/commits/e91ec4fad3366d2dee020919f7c2a0d7b52fd3ea
• https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Access Restriction Bypass in kube-apiserver

CVE-2021-25735 / GHSA-g42g-737j-qx6j / GO-2022-0907

More information

Details

A vulnerability in Kubernetes kube-apiserver could allow node updates to bypass a Validating Admission Webhook and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission controller to accept requests that should be blocked. The vulnerability can be exploited when an update action on node resources is performed and an admission controller is in place and configured to validate the action.

Users are only affected by this vulnerability if they are running a Validating Admission Webhook for Nodes that denies admission based partially on the old state of the Node object. It only impacts validating admission plugins that rely on old values in certain fields and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25735
• https://github.com/kubernetes/kubernetes/issues/100096
• https://github.com/kubernetes/kubernetes/pull/99946
• https://github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
• https://bugzilla.redhat.com/show_bug.cgi?id=1937562
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
• https://pkg.go.dev/k8s.io/kubernetes@v1.23.5/cmd/kube-apiserver
• https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes

CVE-2021-25735 / GHSA-g42g-737j-qx6j / GO-2022-0907

More information

Details

Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-g42g-737j-qx6j
• https://bugzilla.redhat.com/show_bug.cgi?id=1937562
• https://github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
• https://github.com/kubernetes/kubernetes/issues/100096
• https://github.com/kubernetes/kubernetes/pull/99946
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
• https://pkg.go.dev/k8s.io/kubernetes@v1.23.5/cmd/kube-apiserver
• https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Potential proxy IP restriction bypass in Kubernetes

CVE-2020-8562 / GHSA-qh36-44jv-c8xj

More information

Details

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8562
• https://github.com/kubernetes/kubernetes/issues/101493
• https://github.com/kubernetes/kubernetes/issues/101493#issuecomment-2272095629
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY
• https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
• https://security.netapp.com/advisory/ntap-20220225-0002

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes

CVE-2020-8563 / GHSA-5xfg-wv98-264m / GO-2024-2755

More information

Details

Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-5xfg-wv98-264m
• https://bugzilla.redhat.com/show_bug.cgi?id=1886635
• https://github.com/kubernetes/kubernetes/issues/95621
• https://github.com/kubernetes/kubernetes/pull/95236
• https://github.com/kubernetes/kubernetes/pull/95236/commits/247f6dd09299bc7893c1e0affea11c0255025b96
• https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Files or Directories Accessible to External Parties in kubernetes

CVE-2021-25741 / GHSA-f5f7-6478-qm6p / GO-2022-0910

More information

Details

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-f5f7-6478-qm6p
• https://nvd.nist.gov/vuln/detail/CVE-2021-25741
• https://github.com/kubernetes/kubernetes/issues/104980
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://security.netapp.com/advisory/ntap-20211008-0006

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes

CVE-2021-25741 / GHSA-f5f7-6478-qm6p / GO-2022-0910

More information

Details

Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-f5f7-6478-qm6p
• https://github.com/kubernetes/kubernetes/issues/104980
• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://security.netapp.com/advisory/ntap-20211008-0006

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes Sensitive Information leak via Log File

CVE-2020-8564 / GHSA-8mjg-8c8g-6h85 / GO-2021-0066

More information

Details

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8564
• https://github.com/kubernetes/kubernetes/issues/95622
• https://github.com/kubernetes/kubernetes/pull/94712
• https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0066
• https://security.netapp.com/advisory/ntap-20210122-0006

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Sensitive information leak via log file in k8s.io/kubernetes

CVE-2020-8564 / GHSA-8mjg-8c8g-6h85 / GO-2021-0066

More information

Details

Attempting to read a malformed .dockercfg may cause secrets to be inappropriately logged.

Severity

Unknown

References

• https://github.com/kubernetes/kubernetes/pull/94712
• https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634
• https://github.com/kubernetes/kubernetes/issues/95622

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

CVE-2020-8565 / GHSA-8cfg-vx93-jvxw / GO-2021-0064

More information

Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8565
• https://github.com/kubernetes/kubernetes/issues/95623
• https://github.com/kubernetes/kubernetes/pull/95316
• https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3
• https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0
• https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86
• https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373
• https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
• https://github.com/kubernetes/client-go
• https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
• https://pkg.go.dev/vuln/GO-2021-0064

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes

CVE-2021-25736 / GHSA-35c7-w35f-xwgh / GO-2023-2159

More information

Details

Kube-proxy may unintentionally forward traffic in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-35c7-w35f-xwgh
• https://github.com/kubernetes/kubernetes/commit/b014610de3e5cf1bb0f7844b5758d29fc18b75e6
• https://github.com/kubernetes/kubernetes/pull/99958
• https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Unverified Ownership in Kubernetes

CVE-2020-8554 / GHSA-j9wf-vvm6-4r9w

More information

Details

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

Severity

• CVSS Score: 5.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8554
• https://github.com/kubernetes/kubernetes/issues/97076
• https://github.com/kubernetes/kubernetes/issues/97110
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E
• https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
• https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
• https://github.com/kubernetes/kubernetes

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Confused Deputy in Kubernetes

CVE-2020-8561 / GHSA-74j8-88mm-7496

More information

Details

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Severity

• CVSS Score: 4.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-8561
• https://github.com/kubernetes/kubernetes/issues/104720
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY
• https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
• https://security.netapp.com/advisory/ntap-20211014-0002

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Confused Deputy in Kubernetes

CVE-2021-25740 / GHSA-vw47-mr44-3jf9

More information

Details

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25740
• https://github.com/kubernetes/kubernetes/issues/103675
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE
• https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
• https://security.netapp.com/advisory/ntap-20211014-0001

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubelet vulnerable to bypass of seccomp profile enforcement

CVE-2023-2431 / GHSA-xc8m-28vv-4pjc / GO-2023-1864

More information

Details

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2431
• https://github.com/kubernetes/kubernetes/issues/118690
• https://github.com/kubernetes/kubernetes/pull/117020
• https://github.com/kubernetes/kubernetes/pull/117116
• https://github.com/kubernetes/kubernetes/pull/117117
• https://github.com/kubernetes/kubernetes/pull/117118
• https://github.com/kubernetes/kubernetes/pull/117147
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G
• https://pkg.go.dev/vuln/GO-2023-1864

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

CVE-2023-2431 / GHSA-xc8m-28vv-4pjc / GO-2023-1864

More information

Details

Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-xc8m-28vv-4pjc
• https://github.com/kubernetes/kubernetes/issues/118690
• https://github.com/kubernetes/kubernetes/pull/117020
• https://github.com/kubernetes/kubernetes/pull/117116
• https://github.com/kubernetes/kubernetes/pull/117117
• https://github.com/kubernetes/kubernetes/pull/117118
• https://github.com/kubernetes/kubernetes/pull/117147
• https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes mountable secrets policy bypass

CVE-2023-2728 / GHSA-cgcv-5272-97pr / GO-2023-1892

More information

Details

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2728
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
• https://security.netapp.com/advisory/ntap-20230803-0004
• http://www.openwall.com/lists/oss-security/2023/07/06/3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

kube-apiserver vulnerable to policy bypass

CVE-2023-2727 / GHSA-qc2g-gmh6-95p4 / GO-2023-1891

More information

Details

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-2727
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://github.com/kubernetes/kubernetes
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
• https://security.netapp.com/advisory/ntap-20230803-0004
• http://www.openwall.com/lists/oss-security/2023/07/06/2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes

CVE-2023-2727 / GHSA-qc2g-gmh6-95p4 / GO-2023-1891

More information

Details

Vulnerable to policy bypass in kube-apiserver in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-qc2g-gmh6-95p4
• http://www.openwall.com/lists/oss-security/2023/07/06/2
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• https://github.com/kubernetes/kubernetes/pull/118471
• https://github.com/kubernetes/kubernetes/pull/118473
• https://github.com/kubernetes/kubernetes/pull/118474
• https://github.com/kubernetes/kubernetes/pull/118512
• https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

CVE-2023-2728 / GHSA-cgcv-5272-97pr / GO-2023-1892

More information

Details

Kubernetes mountable secrets policy bypass in k8s.io/kubernetes

Severity

Unknown

References

• https://github.com/advisories/GHSA-cgcv-5272-97pr
• http://www.openwall.com/lists/oss-security/2023/07/06/3
• https://github.com/kubernetes/kubernetes/issues/118640
• https://github.com/kubernetes/kubernetes/pull/118356
• [https://github.com/kubernetes/kubernetes/

✂ Note

PR body was truncated to here.

[redhat-renovate-bot]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: downloading golang.org/x/time v0.7.0
go: downloading github.com/prometheus/client_golang v1.19.1
go: downloading google.golang.org/grpc v1.65.0
go: downloading k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
go: downloading k8s.io/kubernetes v1.32.10
go: downloading google.golang.org/protobuf v1.35.1
go: downloading github.com/prometheus/common v0.55.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240826202546-f6391c0de4c7
go: downloading sigs.k8s.io/structured-merge-diff/v4 v4.4.2
go: downloading k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
go: downloading golang.org/x/oauth2 v0.23.0
go: downloading sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3
go: downloading github.com/go-openapi/swag v0.23.0
go: downloading github.com/go-openapi/jsonpointer v0.21.0
go: downloading github.com/fsnotify/fsnotify v1.7.0
go: downloading golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
go: downloading k8s.io/apiserver v0.28.4
go: downloading k8s.io/mount-utils v0.0.0
go: downloading k8s.io/controller-manager v0.0.0
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading github.com/blang/semver v3.5.1+incompatible
go: downloading k8s.io/component-base v0.36.1
go: downloading k8s.io/klog/v2 v2.140.0
go: downloading golang.org/x/sys v0.40.0
go: downloading k8s.io/api v0.36.1
go: downloading k8s.io/apimachinery v0.36.1
go: downloading golang.org/x/time v0.14.0
go: downloading github.com/prometheus/client_model v0.6.2
go: downloading github.com/prometheus/client_golang v1.23.2
go: downloading golang.org/x/net v0.49.0
go: downloading k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
go: downloading sigs.k8s.io/randfill v1.0.0
go: downloading google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
go: downloading github.com/prometheus/common v0.67.5
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409
go: downloading k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
go: downloading sigs.k8s.io/structured-merge-diff/v6 v6.3.2
go: downloading github.com/google/gnostic-models v0.7.0
go: downloading sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730
go: downloading golang.org/x/term v0.39.0
go: downloading golang.org/x/crypto v0.47.0
go: downloading github.com/prometheus/procfs v0.19.2
go: downloading go.yaml.in/yaml/v2 v2.4.3
go: downloading github.com/emicklei/go-restful/v3 v3.13.0
go: downloading github.com/fxamacker/cbor/v2 v2.9.0
go: downloading golang.org/x/text v0.33.0
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading sigs.k8s.io/yaml v1.6.0
go: downloading go.opentelemetry.io/otel/trace v1.41.0
go: downloading github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee
go: downloading github.com/x448/float16 v0.8.4
go: downloading go.opentelemetry.io/otel v1.41.0
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/autoscaling/v2beta1: cannot find module providing package k8s.io/api/autoscaling/v2beta1
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/autoscaling/v2beta2: cannot find module providing package k8s.io/api/autoscaling/v2beta2
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/flowcontrol/v1alpha1: cannot find module providing package k8s.io/api/flowcontrol/v1alpha1
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/networking/v1alpha1: cannot find module providing package k8s.io/api/networking/v1alpha1
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/resource/v1alpha2: cannot find module providing package k8s.io/api/resource/v1alpha2
go: kubevirt.io/hostpath-provisioner/controller imports
	k8s.io/client-go/informers imports
	k8s.io/api/scheduling/v1alpha1: cannot find module providing package k8s.io/api/scheduling/v1alpha1
go: kubevirt.io/hostpath-provisioner/pkg/hostpath imports
	k8s.io/kubernetes/pkg/volume/util/fs imports
	k8s.io/kubernetes/pkg/volume/util/fsquota imports
	k8s.io/mount-utils: reading k8s.io/mount-utils/go.mod at revision v0.0.0: unknown revision v0.0.0
go: kubevirt.io/hostpath-provisioner/pkg/hostpath imports
	k8s.io/kubernetes/pkg/volume/util/fs imports
	k8s.io/kubernetes/pkg/volume/util/fsquota imports
	k8s.io/kubernetes/pkg/features imports
	k8s.io/client-go/features: cannot find module providing package k8s.io/client-go/features
go: kubevirt.io/hostpath-provisioner/pkg/hostpath imports
	k8s.io/kubernetes/pkg/volume/util/fs imports
	k8s.io/kubernetes/pkg/volume/util/fsquota imports
	k8s.io/kubernetes/pkg/features imports
	k8s.io/controller-manager/pkg/features: reading k8s.io/controller-manager/go.mod at revision v0.0.0: unknown revision v0.0.0
go: module github.com/golang/protobuf is deprecated: Use the "google.golang.org/protobuf" module instead.

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubevirt-bot]

@redhat-renovate-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-hostpath-provisioner-sanity	e19b350	link	true	/test pull-hostpath-provisioner-sanity
pull-hpp-unit-test	e19b350	link	false	/test pull-hpp-unit-test
pull-hostpath-provisioner-k8s-e2e-overlay-csi	e19b350	link	true	/test pull-hostpath-provisioner-k8s-e2e-overlay-csi
pull-hostpath-provisioner-e2e-k8s	e19b350	link	true	/test pull-hostpath-provisioner-e2e-k8s
pull-hostpath-provisioner-k8s-e2e-storage	e19b350	link	true	/test pull-hostpath-provisioner-k8s-e2e-storage
pull-hostpath-provisioner-e2e-k8s-ceph	e19b350	link	true	/test pull-hostpath-provisioner-e2e-k8s-ceph

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[redhat-renovate-bot]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v1.32.10). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.