Node disk DOS by writing to container /etc/hosts Analysed #867699 Valid Denial of Service Medium 2020-07-22 $1,000 161 Injection in path parameter of Ingress-nginx Analysed #2701701 Valid Command and Code Injection High 2026-03-07 – 91 elections.k8s.io uses weak session secret key, may place elections at risk Analysed #1387366 Valid Cryptography High 2025-09-19 $250 86 Bypass validation parts in AWS IAM Authenticator for Kubernetes Analysed #1580493 Valid Authentication High 2023-05-25 $2,500 68 CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes Analysed #2231019 Valid Command and Code Injection High 2023-12-21 $5,000 67 Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.io Analysed #746000 Valid Authentication Medium 2020-11-29 $250 62 Ingress nginx annotation injection causes arbitrary command execution Analysed #1728174 Valid Command and Code Injection High 2023-11-24 $2,500 57 Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespaces Analysed #1249583 Valid Access Control High 2021-12-04 – 55 Privilege Escalation in kOps using GCE/GCP Provider Analysed #1842829 Valid Access Control High 2023-08-04 $2,500 52 SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30X Analysed #1544133 Valid Server-Side Request Forgery Medium 2022-12-10 $1,000 51 RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field Analysed #1620702 Valid Command and Code Injection High 2023-10-26 $2,500 47 Loading YAML in Java client can lead to command execution Analysed #1167773 Valid Deserialization and Object Injection Medium 2021-08-07 $1,000 45 Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotation Analysed #2039464 Valid Command and Code Injection High 2023-10-25 $2,500 40 monitoring.prow-canary.k8s.io is vulnerable to CVE-2022-21703 (Grafana 0-day) #1466765 Valid Cross-Site Request Forgery Low 2024-06-25 $100 36 Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces #1378175 Valid Command and Code Injection High 2022-08-13 – 34 File Read Vulnerability allows Attackers to Compromise S3 buckets using Prow #1485500 Valid Access Control Medium 2023-04-25 $250 26 SSRF for kube-apiserver cloudprovider scene #941178 Valid Server-Side Request Forgery Medium 2021-10-07 – 24 Half-Blind SSRF found in kube/cloud-controller-manager can be upgraded to complete SSRF (fully crafted HTTP requests) in vendor managed k8s service. #776017 Valid Server-Side Request Forgery High 2020-10-30 $5,000 21 Broken link hijacking in https://kubernetes-csi.github.io/docs/drivers.html?highlight=chubaofs#production-drivers #1466889 Valid File and Path Handling Low 2022-03-25 $100 18 Broken Domain Link Takeover from kubernetes.io docs #1434179 Valid File and Path Handling Low 2022-04-03 $100 17 Ingress-nginx path allows retrieval of ingress-nginx serviceaccount token #1382919 Valid Access Control High 2022-08-06 $2,500 17 Code Injection via Insecure Yaml.load #1051192 Valid Command and Code Injection Low 2021-05-01 $250 17 Github Account Takeover from Docs page of `kubernetes-csi.github.io` #1434967 Valid Access Control Low 2022-06-04 – 16 Blind SSRF on velodrome.canary.k8s.io #808169 Valid Server-Side Request Forgery Low 2021-01-07 – 16 csi-snapshot-controller crashes when processing VolumeSnapshot with non-existing PVC #1032086 Valid Memory Corruption Medium 2020-12-03 $500 15 Git Arg Injection in kubernetes-sigs/release-sdk #1763704 Valid No weakness recorded Low 2023-05-25 $100 14 Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS #1398706 Valid Access Control Medium 2021-12-16 – 14 Node Validation Admission does not observe all oldObject fields #1095612 Valid Access Control Medium 2021-09-05 – 14 Index Out Of Bounds in protobuf unmarshalling #1073363 Valid Memory Corruption None 2021-08-30 $250 13 Broken Link Hijacking on kubernetes.io Documentation #1331361 Valid Access Control Low 2021-11-06 – 12 SHA512 incorrect on most/many releases #1130416 Valid Cryptography Medium 2021-05-09 – 11 The `io.kubernetes.client.util.generic.dynamic.Dynamics` contains a code execution vulnerability due to SnakeYAML #1807214 Valid Command and Code Injection Medium 2023-04-25 $1,000 10 Compromise of node can lead to compromise of pods on other nodes #863979 Valid No weakness recorded Medium 2020-10-30 – 10 IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements #819717 Valid Cryptography Medium 2021-11-07 – 10 Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests #774896 Valid Denial of Service Medium 2020-10-31 – 9 Compromise of auth via subset/superset namespace names. #778803 Valid Authentication Medium 2020-10-30 – 8 Tokenless GUI Authentication #1350755 Valid Authentication Medium 2021-11-04 – 7 kubeadm logs tokens before deleting them #972561 Valid Authentication Low 2020-11-21 – 7 Bypass apiserver proxy filter #859962 Valid Race Conditions Medium 2021-05-27 – 7 Broken Link Takeover from kubernetes.io docs #1398572 Valid Access Control Low 2021-12-16 – 6 DoS for client-go jsonpath func #882923 Valid Denial of Service Low 2020-07-24 – 6 Grafana Improper authorization #802011 Valid Access Control Low 2020-10-31 – 6 Holes in EndpointSlice Validation Enable Host Network Hijack #1145044 Valid Access Control Low 2021-09-05 – 5 KOPS documentation references domains which were not registered #1092859 Valid Access Control Low 2021-04-02 – 5 Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose" #1398617 Valid Access Control Medium 2021-12-16 – 4 Broken link hijacing in https://kubernetes-csi.github.io/docs/drivers.html #1212853 Valid Misconfiguration and Insecure Design Medium 2021-11-06 – 4 DoS for GCSArtifact.RealAll #833856 Valid Denial of Service Medium 2021-02-04 – 4 secret leaks in vsphere cloud controller manager log #966383 Valid Cryptography Medium 2020-11-29 $500 3 Man in the middle using LoadBalancer or ExternalIPs services #764986 Valid Cryptography Medium 2021-11-04 – 2 CVE-2019-11250 remains in effect. #952771 Valid Cryptography Medium 2020-11-29 – 1