[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
CVE-2026-76654 is an NTLM coercion flaw on Kubernetes Windows nodes. If a pod volumeMount subPath is a symbolic link to an attacker-controlled UNC share, kubelet resolves the link and does not reject the UNC target. The kubelet then attempts NTLM authentication to the share, allowing capture of a NetNTLMv2 response. The disclosure does not report exploitation in the wild.
- Windows kubelet follows a volume subPath symlink to a UNC path.
- It does not reject targets that resolve to an attacker network share.
- The kubelet then authenticates to that share using NTLM.
- An attacker can capture the resulting NetNTLMv2 authentication response.
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-76654 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Nathan Herz on Sep 23 Hello Kubernetes Community, An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2...
This source does not provide full text. Read it at seclists.org.