← Back

CVE-2021-25736

nvd nist
Published: Oct 30, 2023Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 4.0
Source: NVD

Description

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Affected (3)

Kubernetes
1 product
Kubernetes
Configuration A
3 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
From 1.18.0 to 1.18.18
Kubernetes
From 1.19.0 to 1.19.10
Kubernetes
From 1.20.0 to 1.20.6
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-114
Process Control
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

References (6)

Source: jordan@liggitt.net
Third Party Advisory
Source: jordan@liggitt.net
Mailing ListThird Party Advisory
Source: jordan@liggitt.net
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.