Node disk DOS by writing to container /etc/hosts Analysed #867699 Valid Denial of Service Medium 2020-07-22 $1,000 161 Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io Analysed #746000 Valid Authentication Medium 2020-11-29 $250 62 SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X Analysed #1544133 Valid Server-Side Request Forgery Medium 2022-12-10 $1,000 51 Loading YAML in Java client can lead to command execution Analysed #1167773 Valid Deserialization and Object Injection Medium 2021-08-07 $1,000 45 File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow Analysed #1485500 Valid Access Control Medium 2023-04-25 $250 26 SSRF for kube-apiserver cloudprovider scene Analysed #941178 Valid Server-Side Request Forgery Medium 2021-10-07 – 24 Attacker can bypass authentication build on ingress external auth (`nginx.ingress.kubernetes.io/auth-url`) #1357948 Informative Authentication Medium 2022-04-23 – 16 csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC Analysed #1032086 Valid Memory Corruption Medium 2020-12-03 $500 15 Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS Analysed #1398706 Valid Access Control Medium 2021-12-16 – 14 Node Validation Admission does not observe all oldObject fields Analysed #1095612 Valid Access Control Medium 2021-09-05 – 14 Username enumeration via Openssh 7.6 #776461 Informative No weakness recorded Medium 2020-02-04 – 12 SHA512 incorrect on most/many releases #1130416 Valid Cryptography Medium 2021-05-09 – 11 The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML #1807214 Valid Command and Code Injection Medium 2023-04-25 $1,000 10 Compromise of node can lead to compromise of pods on other nodes #863979 Valid No weakness recorded Medium 2020-10-30 – 10 IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements #819717 Valid Cryptography Medium 2021-11-07 – 10 XSS on kubernetes-csi.github.io (mdBook) #1073514 Informative Cross-site Scripting Medium 2021-02-04 – 9 Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests #774896 Valid Denial of Service Medium 2020-10-31 – 9 Compromise of auth via subset/superset namespace names. #778803 Valid Authentication Medium 2020-10-30 – 8 Tokenless GUI Authentication #1350755 Valid Authentication Medium 2021-11-04 – 7 Bypass apiserver proxy filter #859962 Valid Race Conditions Medium 2021-05-27 – 7 AWS Load Balancer Controller Managed Security Groups can be replaced by an unprivileged attacker #1238017 N/A Injection and Smuggling Medium 2022-06-02 $500 5 Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose" #1398617 Valid Access Control Medium 2021-12-16 – 4 Broken link hijacing in https://kubernetes-csi.github.io/docs/drivers.html #1212853 Valid Misconfiguration and Insecure Design Medium 2021-11-06 – 4 Man in the middle leading to root privilege escalation using hostNetwork=true (CAP_NET_RAW considered harmful) #899103 Informative Cryptography Medium 2021-10-08 – 4 Private RSA key and Server key exposed on the GitHub repository #876751 N/A Cryptography Medium 2020-10-22 – 4 DoS for GCSArtifact.RealAll #833856 Valid Denial of Service Medium 2021-02-04 – 4 AWS Load Balancer Controller can be used by an attacker to modify rules of any Security Group that they are able to tag #1238482 N/A Injection and Smuggling Medium 2022-06-02 $500 3 secret leaks in vsphere cloud controller manager log #966383 Valid Cryptography Medium 2020-11-29 $500 3 API Server DoS (crash?) if many large resources (~1MB each) are concurrently/repeatedly sent to an external Validating WebHook endpoint #1096907 Informative Denial of Service Medium 2021-04-01 – 2 Man in the middle using LoadBalancer or ExternalIPs services #764986 Valid Cryptography Medium 2021-11-04 – 2 Kubelet follows symlinks as root in /var/log from the /logs server endpoint #1036886 Informative Access Control Medium 2021-04-01 – 1 csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC #995699 Duplicate Memory Corruption Medium 2021-01-07 – 1 CVE-2019-11250 remains in effect. #952771 Valid Cryptography Medium 2020-11-29 – 1