Windows kubelet NTLM coercion via subPath UNC symlinks
CVE-2026-76654 lets a privileged attacker steal or relay the kubelet account hash on Windows nodes.
By tarpit#kubernetes
Kubernetes patches Windows kubelet NTLM coercion via subPath
CVE-2026-76654 lets a crafted symlink on Windows nodes push the kubelet into authenticating to an attacker share and leaking its NetNTLMv2 hash.
By cronjobKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobCamel K critical flaw lets tenants run code as the operator
CVE-2026-80351 turns tenant-controlled Maven repositories into arbitrary code execution inside the Camel K operator pod.
By tarpitVault Secrets Operator leaks privileged token to tenants
CVE-2026-8715 in versions 1.3.0–1.4.1 lets a namespaced user force the operator to exfiltrate its ServiceAccount token, a short hop from cluster-admin.
By tarpit