Repository navigation
fix(deps): update module k8s.io/kubernetes to v1.32.10 [security] (master) - #26
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Author
|
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
from
November 22, 2024 23:03
9bed4ad to
6b0defc
Compare
renovate
Bot
deleted the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
December 16, 2024 16:33
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
from
December 16, 2024 20:01
271a8d6 to
6b0defc
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
from
February 13, 2025 23:29
6b0defc to
4bf7a0d
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
from
August 27, 2025 20:33
4bf7a0d to
08c99cd
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
from
March 2, 2026 00:11
08c99cd to
b9a6409
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
2 times, most recently
from
April 1, 2026 20:34
b9a6409 to
e2cdd10
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
2 times, most recently
from
April 16, 2026 12:13
e2cdd10 to
8ff9dd9
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
2 times, most recently
from
April 29, 2026 10:54
8ff9dd9 to
6615a1b
Compare
renovate
Bot
force-pushed
the
renovate/master-go-k8s.io-kubernetes-vulnerability
branch
2 times, most recently
from
September 3, 2026 06:08
6615a1b to
26138f4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
v1.23.17→v1.32.10Kubelet vulnerable to bypass of seccomp profile enforcement
CVE-2023-2431 / GHSA-xc8m-28vv-4pjc
More information
Details
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
Severity
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
kube-apiserver vulnerable to policy bypass
CVE-2023-2727 / GHSA-qc2g-gmh6-95p4
More information
Details
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Severity
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes mountable secrets policy bypass
CVE-2023-2728 / GHSA-cgcv-5272-97pr
More information
Details
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the
kubernetes.io/enforce-mountable-secretsannotation are used together with ephemeral containers.Severity
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
kubectl ANSI escape characters not filtered
CVE-2021-25743 / GHSA-f9jg-8p32-2f55
More information
Details
kubectl (k8s.io/kubernetes/pkg/kubectl) does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes privilege escalation vulnerability
CVE-2023-3955 / GHSA-q78c-gwqw-jcmc
More information
Details
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes Improper Input Validation vulnerability
CVE-2023-5528 / GHSA-hq6q-c2x6-hmch
More information
Details
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
CVE-2024-3177 / GHSA-pxhw-596r-rwq5
More information
Details
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
Severity
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes sets incorrect permissions on Windows containers logs
CVE-2024-5321 / GHSA-82m2-cv7p-4m75
More information
Details
A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request
CVE-2024-0793 / GHSA-h7wq-jj8r-qm7p
More information
Details
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes kubelet arbitrary command execution
CVE-2024-10220 / GHSA-27wf-5967-98gx
More information
Details
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Node Denial of Service via kubelet Checkpoint API
CVE-2025-0426 / GHSA-jgfp-53c3-624w
More information
Details
A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.
Severity
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API
CVE-2024-9042 / GHSA-vv39-3w5q-974q
More information
Details
A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
Severity
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Kubernetes Nodes can delete themselves by adding an OwnerReference
CVE-2025-5187 / GHSA-4x4m-3c2p-qppc
More information
Details
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Severity
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
CVE-2025-13281 / GHSA-r6j8-c6r2-37rr
More information
Details
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Severity
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
kubernetes/kubernetes (k8s.io/kubernetes)
v1.32.10: Kubernetes v1.32.10Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.9: Kubernetes v1.32.9Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.8: Kubernetes v1.32.8Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.7: Kubernetes v1.32.7Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.6: Kubernetes v1.32.6Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.5: Kubernetes v1.32.5Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.4: Kubernetes v1.32.4Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.3: Kubernetes v1.32.3Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.2: Kubernetes v1.32.2Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.1: Kubernetes v1.32.1Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.32.0: Kubernetes v1.32.0Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.14: Kubernetes v1.31.14Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.13: Kubernetes v1.31.13Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.12: Kubernetes v1.31.12Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.11: Kubernetes v1.31.11Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.10: Kubernetes v1.31.10Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.9: Kubernetes v1.31.9Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.8: Kubernetes v1.31.8Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.7: Kubernetes v1.31.7Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.6: Kubernetes v1.31.6Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.5: Kubernetes v1.31.5Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.4: Kubernetes v1.31.4Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.3: Kubernetes v1.31.3Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.2: Kubernetes v1.31.2Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.1: Kubernetes v1.31.1Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.31.0: Kubernetes v1.31.0Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.30.14: Kubernetes v1.30.14Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.30.13: Kubernetes v1.30.13Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.30.12: Kubernetes v1.30.12Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.
See the CHANGELOG for more details.
v1.30.11: Kubernetes v1.30.11Compare Source
See kubernetes-announce@. Additional binary downloads are linked in the [CHANGELOG](https://redirect.github.com/kubernetes/kub
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.