Kubernetes (Organization): news timeline & CVEs

[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion

Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.

CVE-2026-76654 is an NTLM coercion flaw on Kubernetes Windows nodes. If a pod volumeMount subPath is a symbolic link to an attacker-controlled UNC share, kubelet resolves the link and does not reject the UNC target. The kubelet then attempts NTLM authentication to the share, allowing capture of a NetNTLMv2 response. The disclosure does not report exploitation in the wild.

oss-securitySep 23, 23:50 UTC · 3d agoVulnerability 2 sources CVE-2026-76654

[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.

CVE-2026-2270 is a confused-deputy flaw in the Kubernetes StatefulSet controller. A user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects can cause creation of a pod in another namespace. The attacker has full control of the pod's metadata and specification, including the target namespace. The disclosure notes the cross-namespace pod is immediately deleted and does not report in-the-wild exploitation.

oss-securitySep 23, 23:48 UTC · 3d agoVulnerability 2 sources CVE-2026-2270

Kubernetes

Timeline2 articles

Related CVEsby mentions

Appears with

[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion

[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation