CVE-2026-76654

MediumCVSS 5.8/10Last modified Nov 3, 2026

Description

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 26, 2026
Last modified
Nov 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-766557.5A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code executionCVE-2026-766565.3A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroCVE-2026-7665710.0Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attCVE-2026-7665810.0A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker CVE-2026-766597.5A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of serCVE-2026-76663.1An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to pCVE-2026-766608.7A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766617.6A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.CVE-2026-766625.9A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.CVE-2026-766637.5A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.CVE-2026-766646.4A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsCVE-2026-766657.1A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
CVE-2026-76654: Medium severity, CVSS 5.8 | Vulnix