129 matches found
CVE-2021-25735
CVE-2021-25735 CVE-2021-25735 を悪用する: Kubernetes Validating Admission Webhook バイパス 脆弱性環境のセットアップ まず、gencerts.sh スクリプトを実行して TLS 証明書と鍵を生成します。 bash gencerts.sh アドミッションコントローラをデプロイするには、以下のコマンドを使用して Docker コンテナイメージをローカルでビルドし、タグを付け、イメージを Dockerhub にプッシュする必要があります。 docker login docker build -t...
CVE-2025-1974-poc
POC of IngressNightmare, RCE in Ingress NGINX CVE-2025-1974 開発元: https://github.com/zwxxb/CVE-2025-1974/blob/main/poc.py https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilitieshow-did-we-discover-ingressnightmare-24 謝辞 使用方法 root@kitploit: forward the admission webhook kubectl port-forwar...
ingressNightmare-CVE-2025-1974-exps
Ingress Nightmare CVE-2025-1907 説明 この脆弱性により、リモート攻撃者が kubernetes/ingress-nginx の影響を受けるインストール上で任意のコードを実行できるようになります。この脆弱性を悪用するのに認証は必要ありません。特定の欠陥は HTTP リクエストの処理に存在します。...
CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity
CVE-2026-5556 – Kubernetes アドミッションコントローラーの大文字小文字の区別によるバイパス プログラムコード（Python アドミッションウェブフック＋エクスプロイト） root@kitploit: !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES =...
CVE-2026-78427
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427
NeuVector's admission webhook contains a bypass vulnerability where containers whose image path matches one of three hardcoded service mesh sidecar images are silently excluded from policy evaluation. Since the image path is fully controlled by the workload author, any user with permission to dep...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
EUVD-2026-81416
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427 Admission Control Bypass via Hardcoded Sidecar Image Exemption
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
CVE-2026-78427: Reliance on Untrusted Inputs in a Security Decision
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission den...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded request body reads in the Kubernetes admission webhook handler in dataclients/kubernetes/admission/admission.go. An attacker can exhaust memory and OOM-kill the skipp...
CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...
CVE-2026-54247 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...
CVE-2026-54247
Skipper (Zalando's HTTP router and reverse proxy) contains an unbounded memory allocation in its Kubernetes admission webhook handler (dataclients/kubernetes/admission/admission.go). The handler calls io.ReadAll(r.Body) without enforcing a size limit, so an attacker with in-cluster network access...
SUSE CVE-2026-50570
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...
SUSE CVE-2026-65834
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...
GO-2026-6160 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...
