[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
CVE-2026-76654 is an NTLM coercion flaw on Kubernetes Windows nodes. If a pod volumeMount subPath is a symbolic link to an attacker-controlled UNC share, kubelet resolves the link and does not reject the UNC target. The kubelet then attempts NTLM authentication to the share, allowing capture of a NetNTLMv2 response. The disclosure does not report exploitation in the wild.
58