[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
CVE-2026-76654 is an NTLM coercion flaw on Kubernetes Windows nodes. If a pod volumeMount subPath is a symbolic link to an attacker-controlled UNC share, kubelet resolves the link and does not reject the UNC target. The kubelet then attempts NTLM authentication to the share, allowing capture of a NetNTLMv2 response. The disclosure does not report exploitation in the wild.
- Windows kubelet follows a volume subPath symlink to a UNC path.
- It does not reject targets that resolve to an attacker network share.
- The kubelet then authenticates to that share using NTLM.
- An attacker can capture the resulting NetNTLMv2 authentication response.
- CVEs
- CVE-2026-76654
- Products
- Kubernetes
- Organizations
- Kubernetes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76654 | NTLM coercion via subPath symlink on Windows Kubernetes nodes | 5.8 | — |
From the original article
Posted by Nathan Herz on Sep 23 Hello Kubernetes Community, An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.