# Official CVE Feed

Official CVE FeedFEATURE STATE: Kubernetes v1.27 [beta]This is a community maintained list of official CVEs announced by the Kubernetes Security Response Committee. See Kubernetes Security and Disclosure Information for more details.The Kubernetes project publishes a programmatically accessible feed of published security issues in JSON feed and RSS feed formats. You can access it by executing the following commands:Link to JSON formatcurl -Lv https://k8s.io/docs/reference/issues-security/official-cve-feed/index.json Link to RSS formatcurl -Lv https://k8s.io/docs/reference/issues-security/official-cve-feed/feed.xml Official Kubernetes CVE List (last updated: 27 Sep 2025 10:53:07 UTC)CVE IDIssue SummaryCVE GitHub Issue URLCVE-2025-9708Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks#134063CVE-2025-7445secrets-store-sync-controller discloses service account tokens in logs#133897CVE-2025-5187Nodes can delete themselves by adding an OwnerReference#133471CVE-2025-7342VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override#133115CVE-2025-4563Nodes can bypass dynamic resource allocation authorization checks#132151CVE-2025-1974ingress-nginx admission controller RCE escalation#131009CVE-2025-1098ingress-nginx controller configuration injection via unsanitized mirror annotations#131008CVE-2025-1097ingress-nginx controller configuration injection via unsanitized auth-tls-match-cn annotation#131007CVE-2025-24514ingress-nginx controller configuration injection via unsanitized auth-url annotation#131006CVE-2025-24513ingress-nginx controller auth secret file path traversal vulnerability#131005CVE-2025-1767GitRepo Volume Inadvertent Local Repository Access#130786CVE-2025-0426Node Denial of Service via kubelet Checkpoint API#130016CVE-2024-9042Command Injection affecting Windows nodes via nodes/*/logs/query API#129654CVE-2024-10220Arbitrary command execution through gitRepo volume#128885CVE-2024-9594VM images built with Image Builder with some providers use default credentials during builds#128007CVE-2024-9486VM images built with Image Builder and Proxmox provider use default credentials#128006CVE-2024-7646Ingress-nginx Annotation Validation Bypass#126744CVE-2024-7598Network restriction bypass via race condition during namespace termination#126587CVE-2024-5321Incorrect permissions on Windows containers logs#126161CVE-2024-3744azure-file-csi-driver discloses service account tokens in logs#124759CVE-2024-3177Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin#124336CVE-2023-5528Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes#121879CVE-2023-5044Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation#126817CVE-2023-5043Ingress nginx annotation injection causes arbitrary command execution#126816CVE-2022-4886ingress-nginx path sanitization can be bypassed#126815CVE-2023-3955Insufficient input sanitization on Windows nodes leads to privilege escalation#119595CVE-2023-3893Insufficient input sanitization on kubernetes-csi-proxy leads to privilege escalation#119594CVE-2023-3676Insufficient input sanitization on Windows nodes leads to privilege escalation#119339CVE-2023-2431Bypass of seccomp profile enforcement#118690CVE-2023-2728Bypassing policies imposed by the ImagePolicyWebhook and bypassing mountable secrets policy imposed by the ServiceAccount admission plugin#118640CVE-2023-2727Bypassing policies imposed by the ImagePolicyWebhook and bypassing mountable secrets policy imposed by the ServiceAccount admission plugin#118640CVE-2023-2878secrets-store-csi-driver discloses service account tokens in logs#118419CVE-2022-3294Node address isn't always verified when proxying#113757CVE-2022-3162Unauthorized read of Custom Resources#113756CVE-2022-3172Aggregated API server can cause clients to be redirected (SSRF)#112513CVE-2021-25749`runAsNonRoot` logic bypass for Windows containers#112192CVE-2021-25748Ingress-nginx `path` sanitization can be bypassed with newline character#126814CVE-2021-25746Ingress-nginx directive injection via annotations#126813CVE-2021-25745Ingress-nginx `path` can be pointed to service account token file#126812CVE-2021-25742Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces#126811CVE-2021-25741Symlink Exchange Can Allow Host Filesystem Access#104980CVE-2021-25737Holes in EndpointSlice Validation Enable Host Network Hijack#102106CVE-2021-3121Processes may panic upon receipt of malicious protobuf messages#101435CVE-2021-25735Validating Admission Webhook does not observe some previous fields#100096CVE-2020-8554Man in the middle using LoadBalancer or ExternalIPs#97076CVE-2020-8566Ceph RBD adminSecrets exposed in logs when loglevel >= 4#95624CVE-2020-8565Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9#95623CVE-2020-8564Docker config secrets leaked when file is malformed and log level >= 4#95622CVE-2020-8563Secret leaks in kube-controller-manager when using vSphere provider#95621CVE-2020-8557Node disk DOS by writing to container /etc/hosts#93032CVE-2020-8559Privilege escalation from compromised node to cluster#92914CVE-2020-8558Node setting allows for neighboring hosts to bypass localhost boundary#92315CVE-2020-8555Half-Blind SSRF in kube-controller-manager#91542CVE-2020-10749IPv4 only clusters susceptible to MitM attacks via IPv6 rogue router advertisements#91507CVE-2019-11254kube-apiserver Denial of Service vulnerability from malicious YAML payloads#89535CVE-2020-8552apiserver DoS (oom)#89378CVE-2020-8551Kubelet DoS via API#89377CVE-2020-8553ingress-nginx auth-type basic annotation vulnerability#126818CVE-2019-11251kubectl cp symlink vulnerability#87773CVE-2018-1002102Unvalidated redirect#85867CVE-2019-11255CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation#85233CVE-2019-11253Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack#83253CVE-2019-11250Bearer tokens are revealed in logs (audit finding TOB-K8S-001)#81114CVE-2019-11248/debug/pprof exposed on kubelet's healthz port#81023CVE-2019-11249Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal#80984CVE-2019-11247API server allows access to custom resources via wrong scope#80983CVE-2019-11245container uid changes to root after first restart or if image is already pulled to the node#78308CVE-2019-11243rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()#76797CVE-2019-11244`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files#76676CVE-2019-1002100json-patch requests can exhaust apiserver resources#74534CVE-2018-1002105proxy request handling in kube-apiserver can leave vulnerable TCP connections#71411CVE-2018-1002101smb mount security issue#65750CVE-2018-1002100Kubectl copy doesn't check for paths outside of it's destination directory.#61297CVE-2017-1002102atomic writer volume handling allows arbitrary file deletion in host filesystem#60814CVE-2017-1002101subpath volume mount handling allows arbitrary file access in host filesystem#60813CVE-2017-1002100Azure PV should be Private scope not Container scope#47611CVE-2017-1000056PodSecurityPolicy admission plugin authorizes incorrectly#43459This feed is auto-refreshing with a noticeable but small lag (minutes to hours) from the time a CVE is announced to the time it is accessible in this feed.The source of truth of this feed is a set of GitHub Issues, filtered by a controlled and restricted label official-cve-feed. The raw data is stored in a Google Cloud Bucket which is writable only by a small number of trusted members of the Community.