Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HKubernetes Java
APPKubernetes≤ 9.0.210.0.0 – 10.0.111.0.0 – 11.0.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEContainerDeserialization
References
Related vulnerabilities
CVE-2020-8570CRITICAL9.1ten sam produkt
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside o...
CVE-2026-33519CRITICAL9.8PL ✓ten sam vendor
Nieprawidłowa autoryzacja w Esri Portal for ArcGIS — obejście uprawnień
CVE-2025-57870CRITICAL10.0PL ✓ten sam vendor
SQL Injection w Esri ArcGIS Server — zdalny dostęp bez uwierzytelnienia
CVE-2023-1174CRITICAL9.8ten sam vendor
This vulnerability exposes a network port in minikube running on macOS with Docker driver that could enable un...
CVE-2018-1002105CRITICAL9.8ten sam vendor
In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to p...