CVEvulnerability

CVE-2021-25735

6.5 MEDIUM Published 2021-09-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-09-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-372

Description

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Affected configurations

• kubernetes kubernetes (< 1.18.18) • kubernetes kubernetes (>= 1.19.0 < 1.19.10) • kubernetes kubernetes (>= 1.20.0 < 1.20.6)

Related

Weakness · CWE (1)

  • CWE-372 Incomplete Internal State Distinction weakness

References