[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
58
CVE-2026-76654
NTLM coercion via subPath symlink on Windows Kubernetes nodes
- CVSS 3.1
- 5.8 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
On Windows Kubernetes nodes, a kubelet that resolves a pod volumeMount subPath does not reject a symbolic link whose target is a UNC path. An attacker who can set that subPath to a share they control causes the kubelet to authenticate with NTLM and disclose the NetNTLMv2 hash of the kubelet account. The hash can be cracked or, if the node is domain-joined, relayed to impersonate the node.
What to do: Apply Kubernetes's update for CVE-2026-76654. No workaround is stated.
| Product | Affected |
|---|---|
| Kubernetes kubelet (Windows nodes) | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
- Weakness
- CWE-59
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N