CVE-2021-25735
Validating Admission Webhook does not observe some previous fields
MEDIUM 6.5EPSS 5.4%
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
- Affected
- Kubernetes
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - CVSS v2.0 NVD
- 5.5 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:P - EPSS
- 5.38% chance of exploitation in the next 30 days, 93rd percentile
- Published
- 2021-09-06
- Updated
- 2024-09-16
Proof-of-concept exploits (1)
- darryk10/CVE-2021-2573517★ · 2021-04-23
Exploit collections (1)
- Kubernetes 准入机制绕过（CVE-2021-25735）.mdtzwlhack/Vulnerability
Security advisories
- kubernetes/kubernetes/issues/100096
- https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
- advisories/GHSA-g42g-737j-qx6j