UNKNOWN Kubernetes
CVE-2026-76654
Subpath symlinking on Windows nodes permits NTLM coercion
CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium (5.8)
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM.
This allows an attacker to obtain the NetNTLMv2 hash of
Affected Products
- kubelet: <= v1.34.11 kubelet: <= v1.35.8 kubelet: <= v1.36.4 kubelet: = v1.37.0
References
- https://github.com/kubernetes/kubernetes/issues/142098
- https://www.cve.org/cverecord?id=CVE-2026-76654
- https://nvd.nist.gov/vuln/detail/CVE-2026-76654
This unknown severity vulnerability was published on 2026-09-14 via Kubernetes. Affected: kubelet: <= v1.34.11 kubelet: <= v1.35.8 kubelet: <= v1.36.4 kubelet: = v1.37.0.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.