Kube-apiserver vulnerabilities

2 known vulnerabilities in Kube-apiserver from Kubernetes. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  kube-apiserver: Server-Side Request Forgery

  CVE-2022-3172Nov 3, 2023KubernetesEPSS 2.46%

  A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties

• 8.0 High severity

  Red Hat OpenShift Container Platform 4.10: Authentication Bypass Using an Alternate Path or Channel

  CVE-2023-1260Sep 24, 2023Red HatEPSS 1.56%

  An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would th