csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Analysed #1032086 Valid Memory Corruption Medium 2020-12-03 $500 15 Blind SSRF on velodrome.canary.k8s.io Analysed #808169 Valid Server-Side Request Forgery Low 2021-01-07 – 16 Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`) #1357948 Informative Authentication Medium 2022-04-23 – 16 Github Account Takeover from Docs page of `kubernetes-csi.github.io` Analysed #1434967 Valid Access Control Low 2022-06-04 – 16 Code Injection via Insecure Yaml.load Analysed #1051192 Valid Command and Code Injection Low 2021-05-01 $250 17 Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token Analysed #1382919 Valid Access Control High 2022-08-06 $2,500 17 Broken Domain Link Takeover from kubernetes.io docs Analysed #1434179 Valid File and Path Handling Low 2022-04-03 $100 17 Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers Analysed #1466889 Valid File and Path Handling Low 2022-03-25 $100 18 Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service. Analysed #776017 Valid Server-Side Request Forgery High 2020-10-30 $5,000 21 SSRF for kube-apiserver cloudprovider scene Analysed #941178 Valid Server-Side Request Forgery Medium 2021-10-07 – 24 File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow Analysed #1485500 Valid Access Control Medium 2023-04-25 $250 26 Development Application Credentials + Information Exposed #1018413 Duplicate Cryptography High 2020-12-03 – 31 Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces Analysed #1378175 Valid Command and Code Injection High 2022-08-13 – 34 monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day) Analysed #1466765 Valid Cross-Site Request Forgery Low 2024-06-25 $100 36 Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotation Analysed #2039464 Valid Command and Code Injection High 2023-10-25 $2,500 40 Loading YAML in Java client can lead to command execution Analysed #1167773 Valid Deserialization and Object Injection Medium 2021-08-07 $1,000 45 RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field Analysed #1620702 Valid Command and Code Injection High 2023-10-26 $2,500 47 SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X Analysed #1544133 Valid Server-Side Request Forgery Medium 2022-12-10 $1,000 51 Privilege Escalation in kOps using GCE/GCP Provider Analysed #1842829 Valid Access Control High 2023-08-04 $2,500 52 Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespaces Analysed #1249583 Valid Access Control High 2021-12-04 – 55 Ingress nginx annotation injection causes arbitrary command execution Analysed #1728174 Valid Command and Code Injection High 2023-11-24 $2,500 57 Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io Analysed #746000 Valid Authentication Medium 2020-11-29 $250 62 CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes Analysed #2231019 Valid Command and Code Injection High 2023-12-21 $5,000 67 Bypass validation parts in AWS IAM Authenticator for Kubernetes Analysed #1580493 Valid Authentication High 2023-05-25 $2,500 68 elections.k8s.io uses weak session secret key, may place elections at risk Analysed #1387366 Valid Cryptography High 2025-09-19 $250 86 Injection in path parameter of Ingress-nginx Analysed #2701701 Valid Command and Code Injection High 2026-03-07 – 91 Node disk DOS by writing to container /etc/hosts Analysed #867699 Valid Denial of Service Medium 2020-07-22 $1,000 161