LOW3.1

GHSA-vw47-mr44-3jf9

Confused Deputy in Kubernetes

Details

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/k8s.io/kubernetes

Introduced in: 0

No fixed version published yet for k8s.io/kubernetes (go modules). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-25740[ADVISORY]
https://github.com/kubernetes/kubernetes/issues/103675[WEB]
https://github.com/kubernetes/kubernetes[PACKAGE]
https://groups.google.com/g/kubernetes-security-announce/c/WYE9ptrhSLE[WEB]
https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves[WEB]
https://security.netapp.com/advisory/ntap-20211014-0001[WEB]