# Security Hardening and Compliance Assessment of Kubernetes Control Plane and Workloads
## 5 Kubernetes Vulnerabilities and Kubernetes Penetration Testing
### Kubernetes CVEs  
Kubernetes has become a fundamental technology in the swiftly advancing field of cloud-native infrastructure, managing containerized applications on a large scale. Its widespread popularity has rendered it a common subject for security analysis and exploitation. Organizations adopt a proactive security approach by utilizing standardized vulnerability disclosures via the Common Vulnerabilities and Exposures (CVE) system, which is essential for evaluating risks, prioritizing patches, and implementing countermeasures in Kubernetes environments. CVEs document vulnerabilities' technical specifics, facilitate tools' interoperability, and enhance transparency within the security community [30]. Recent studies underscore the limitations in the consistency, timeliness, and accuracy of CVE data, particularly when utilized in complex platforms such as Kubernetes. Document inconsistencies in version information, discrepancies in CVSS scores, and traceability gaps in public databases such as NVD and CVE may influence organizational responses to emerging threats [32; 34]. Considering the rising frequency of vulnerability disclosures in cloud platforms and third-party extensions, it is essential to contextualize CVE data with specific mitigation strategies. This section consolidates the most recent Kubernetes-related CVEs, providing succinct descriptions and suggested actions based on the latest intelligence. Here is a list of some of the latest, significant Kubernetes-related CVEs and their recommended mitigation strategies:1. CVE-2025-1974  
Component: Ingress-NGINX Controller  
This significant vulnerability permits unauthenticated attackers within the pod network to execute arbitrary code in the context of the ingress-nginx controller. Successful exploitation may result in the revelation of confidential information and the compromise of resources across the cluster. Mitigation: Upgrade ingress-nginx to a revised version outlined in Kubernetes security bulletins. Implement network access restrictions and role-based access control (RBAC) policies to mitigate exposure to untrusted sources. 2. CVE-2025-1098  
Component: Ingress-NGINX Controller  
This vulnerability enables remote code execution by exploiting the ingress-nginx controller, representing a significant risk to Kubernetes environments. Malefactors may potentially obtain access to cluster internals or confidential information. Mitigation: Implement the most recent security update for ingress-nginx. Consistently evaluate cluster ingress configurations and implement network segmentation to restrict access. 3. CVE-2025-1097  
Component: Ingress-NGINX Controller  
This critical vulnerability enables attackers to execute remote code by leveraging configuration deficiencies. That may result in total control over ingress-nginx and its related workloads. To reduce severity or seriousness, update the most recent version of ingress-nginx, perform regular configuration assessments, and implement least privilege protocols. 4. CVE-2025-24514  
Component: Ingress-NGINX Controller  
This vulnerability allows attackers to achieve unauthorized code execution via specially crafted requests aimed at ingress-nginx, compromising container integrity and security. Mitigation: Upgrade ingress-nginx as recommended in the Kubernetes CVE feed. Examine logs for anomalous ingress activity and implement rigorous input validation on annotations. 5. CVE-2024-9042  
Kubelet on Windows Nodes  
Insufficient validation of the \"pattern\" parameter in NodeLogQuery requests may permit command injection on Windows worker nodes. That could facilitate privilege escalation or unauthorized command execution. Reduction in adverse effects: Upgrade Windows kubelets to the specified versions: v1.32.1, v1.31.5, v1.30.9, or v1.29.13. Segregate Windows workloads utilizing stringent RBAC and firewall protocols. 6.