Kubernetes vulnerabilities
CVEs whose affected-version data names the Kubernetes package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-76654Medium· 5.8Subpath symlinking on Windows nodes permits NTLM coercion
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject …
CVE-2026-2270Medium· 5.9StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerabi…
CVE-2026-19444Medium· 6.5A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the netw…