CVE-2026-76654

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/kubernetes/kubernetes/issues/142098
https://groups.google.com/g/kubernetes-security-announce/c/Wkv04IFzW8g
http://www.openwall.com/lists/oss-security/2026/09/23/36

Configurations

No configuration.

History

27 Oct 2026, 00:17

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/09/23/36 -

26 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-26 23:17

Updated : 2026-10-27 15:09

NVD link : CVE-2026-76654

Mitre link : CVE-2026-76654

CVE.ORG link : CVE-2026-76654

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-76654", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "jordan@liggitt.net", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.3}]}, "affected": [{"source": "jordan@liggitt.net", "affectedData": [{"vendor": "Kubernetes", "product": "Kubernetes", "versions": [{"status": "affected", "version": "v1.34.0", "versionType": "custom", "lessThanOrEqual": "v1.34.11"}, {"status": "affected", "version": "v1.35.0", "versionType": "custom", "lessThanOrEqual": "v1.35.8"}, {"status": "affected", "version": "v1.36.0", "versionType": "custom", "lessThanOrEqual": "v1.36.4"}, {"status": "affected", "version": "v1.37.0", "versionType": "custom", "lessThanOrEqual": "v1.37.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-26T23:17:09.750", "references": [{"url": "https://github.com/kubernetes/kubernetes/issues/142098", "source": "jordan@liggitt.net"}, {"url": "https://groups.google.com/g/kubernetes-security-announce/c/Wkv04IFzW8g", "source": "jordan@liggitt.net"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/23/36", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "jordan@liggitt.net", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined."}], "lastModified": "2026-10-27T15:09:59.900", "sourceIdentifier": "jordan@liggitt.net"}