Node address isn't always verified when proxying
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | up to v1.25.3; up to v1.24.7; up to v1.23.13; up to v1.22.15 | — | No fix listed | CNA |
| — | github.com/kubernetes/kubernetes (Go) | 1.25.0 to before 1.25.4 | 1.25.4 | Patch available | GHSA-jh36-q97c-9928 |
| — | github.com/kubernetes/kubernetes (Go) | 1.24.0 to before 1.24.8 | 1.24.8 | Patch available | GHSA-jh36-q97c-9928 |
| — | github.com/kubernetes/kubernetes (Go) | 1.23.0 to before 1.23.14 | 1.23.14 | Patch available | GHSA-jh36-q97c-9928 |
| — | github.com/kubernetes/kubernetes (Go) | 1.22.0 to before 1.22.16 | 1.22.16 | Patch available | GHSA-jh36-q97c-9928 |
- Kubernetes VendorKubernetes Affected up to v1.25.3; up to v1.24.7; up to v1.23.13; up to v1.22.15 Fixed in — No fix listed CNA
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.25.0 to before 1.25.4 Fixed in 1.25.4 Patch available GHSA-jh36-q97c-9928
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.24.0 to before 1.24.8 Fixed in 1.24.8 Patch available GHSA-jh36-q97c-9928
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.23.0 to before 1.23.14 Fixed in 1.23.14 Patch available GHSA-jh36-q97c-9928
- github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.22.0 to before 1.22.16 Fixed in 1.22.16 Patch available GHSA-jh36-q97c-9928
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | before 1.22.16; 1.23.0 to before 1.23.14; 1.24.0 to before 1.24.8; 1.25.0 to before 1.25.4 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.22.16; 1.23.0 to before 1.23.14; 1.24.0 to before 1.24.8; 1.25.0 to before 1.25.4 Vulnerable ·Kubernetes
Remediation
- Fix · GHSA-jh36-q97c-9928 github.com/kubernetes/kubernetes (Go) Fixed in 1.25.4 Advisory →
- Fix · GHSA-jh36-q97c-9928 github.com/kubernetes/kubernetes (Go) Fixed in 1.24.8 Advisory →
- Fix · GHSA-jh36-q97c-9928 github.com/kubernetes/kubernetes (Go) Fixed in 1.23.14 Advisory →
- Fix · GHSA-jh36-q97c-9928 github.com/kubernetes/kubernetes (Go) Fixed in 1.22.16 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4.12 | Fixed | — |
Not affected: 2 products
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
Timeline
- 2026-10-02 Threatist record created from CVE-2022-3294
- 2026-10-03 Alias added: GHSA-jh36-q97c-9928
References
Advisory 2
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2022-3294 · CVE Program
- CVE-2022-3294 · NVD
- FIRST EPSS
- GHSA-jh36-q97c-9928 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-3294 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences