Validating Admission Webhook does not observe some previous fields
Priority LOW 37CWE-372Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Why it matters now
EPSS 0.05375 92nd percentileScored 2026-11-07
Fix Partial k8s.io/kubernetes (Go): 1.20.6, 1.19.10, 1.18.18Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | up to 1.18.17; up to 1.19.9; up to 1.20.5 | — | No fix listed | CNA |
| — | k8s.io/kubernetes (Go) | 1.20.0 to before 1.20.6 | 1.20.6 | Patch available | GHSA-g42g-737j-qx6j |
| — | k8s.io/kubernetes (Go) | 1.19.0 to before 1.19.10 | 1.19.10 | Patch available | GHSA-g42g-737j-qx6j |
| — | k8s.io/kubernetes (Go) | before 1.18.18 | 1.18.18 | Patch available | GHSA-g42g-737j-qx6j |
- Kubernetes VendorKubernetes Affected up to 1.18.17; up to 1.19.9; up to 1.20.5 Fixed in — No fix listed CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.20.0 to before 1.20.6 Fixed in 1.20.6 Patch available GHSA-g42g-737j-qx6j
- k8s.io/kubernetes (Go) Vendor— Affected 1.19.0 to before 1.19.10 Fixed in 1.19.10 Patch available GHSA-g42g-737j-qx6j
- k8s.io/kubernetes (Go) Vendor— Affected before 1.18.18 Fixed in 1.18.18 Patch available GHSA-g42g-737j-qx6j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | before 1.18.18; 1.19.0 to before 1.19.10; 1.20.0 to before 1.20.6 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.18.18; 1.19.0 to before 1.19.10; 1.20.0 to before 1.20.6 Vulnerable ·Kubernetes
Remediation
- Fix · GHSA-g42g-737j-qx6j k8s.io/kubernetes (Go) Fixed in 1.20.6 Advisory →
- Fix · GHSA-g42g-737j-qx6j k8s.io/kubernetes (Go) Fixed in 1.19.10 Advisory →
- Fix · GHSA-g42g-737j-qx6j k8s.io/kubernetes (Go) Fixed in 1.18.18 Advisory →
Red Hat 1 advisory
- RHSA-2021:2437 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 packages and security update
- Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2437 |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4.8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25735
- 2026-10-03 Alias added: GHSA-g42g-737j-qx6j
References
Advisory 2
Other 6
- https://github.com/kubernetes/kubernetes/pull/99946
- https://github.com/kubernetes/kubernetes/commit/00e81db174ef7aca497be5f42d87e46d14df2a90
- https://bugzilla.redhat.com/show_bug.cgi?id=1937562
- https://github.com/kubernetes/kubernetes
- https://pkg.go.dev/k8s.io/[email protected]/cmd/kube-apiserver
- https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2021-25735 · CVE Program
- CVE-2021-25735 · NVD
- FIRST EPSS
- GHSA-g42g-737j-qx6j · GitHub Advisory Database · CC BY 4.0
- CVE-2021-25735 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences