VULNERABILITY INTELLIGENCE

CVE-2021-25735

CVSS score6.5 MEDIUM

EPSS probability5.38%

CISA KEVNot currently listed

Published2021-09-06

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Description

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Weakness classification

jordan@liggitt.net: CWE-372
nvd@nist.gov: NVD-CWE-Other

Primary references

jordan@liggitt.net — Patch, Third Party Advisory
jordan@liggitt.net — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory