← Back

CVE-2021-25735

nvd nist
Published: Sep 6, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Exploitability: 1.2 / Impact: 5.2
Source: NVD

Description

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Affected (3)

Kubernetes
1 product
Kubernetes
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
Before 1.18.18
Kubernetes
From 1.19.0 to 1.19.10
Kubernetes
From 1.20.0 to 1.20.6

Related CWEs

CWE-372
Incomplete Internal State Distinction
The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

References (4)

Source: jordan@liggitt.net
PatchThird Party Advisory
Source: jordan@liggitt.net
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.