CVE-2021-25735

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-372

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-257366.3Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBa CVE-2021-257374.8A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes alr CVE-2021-257386.7Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.CVE-2021-257403.1A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have a CVE-2021-257418.1A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & di CVE-2021-257427.1A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature CVE-2021-257433.0kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not l CVE-2021-257458.1A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[CVE-2021-257467.1A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an CVE-2021-257486.5A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypas CVE-2021-257497.8Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.CVE-2021-257552.5In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.