130 matches found
CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity
CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity Program Code Python admission webhook + exploit !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES ...
CVE-2021-25735
CVE-2021-25735 Exploit CVE-2021-25735: Kubernetes Validating Admission Webhook Bypass Set the Vulnerable Environment Let's start with running the script gencerts.sh to generate TLS certificates and keys. bash gencerts.sh To deploy the admission controller you need to build the Docker container...
CVE-2025-1974-poc
POC de IngressNightmare, RCE en Ingress NGINX CVE-2025-1974 Desarrollado a partir de: https://github.com/zwxxb/CVE-2025-1974/blob/main/poc.py https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilitieshow-did-we-discover-ingressnightmare-24 Gracias Instrucciones de uso forward the admission...
ingressNightmare-CVE-2025-1974-exps
Ingress Nightmare CVE-2025-1907 Description This vulnerability allows remote attackers to execute arbitrary code on affected installations of kubernetes/ingress-nginx. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. It i...
CVE-2026-78427
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427
NeuVector's admission webhook contains a bypass vulnerability where containers whose image path matches one of three hardcoded service mesh sidecar images are silently excluded from policy evaluation. Since the image path is fully controlled by the workload author, any user with permission to dep...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
EUVD-2026-81416
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded request body reads in the Kubernetes admission webhook handler in dataclients/kubernetes/admission/admission.go. An attacker can exhaust memory and OOM-kill the skipp...
CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...
CVE-2026-54247
Skipper (Zalando's HTTP router and reverse proxy) contains an unbounded memory allocation in its Kubernetes admission webhook handler (dataclients/kubernetes/admission/admission.go). The handler calls io.ReadAll(r.Body) without enforcing a size limit, so an attacker with in-cluster network access...
CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...
SUSE CVE-2026-50570
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...
SUSE CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...
GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...
