CVE-2026-76654
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's…
- Risk score
- 42/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 26 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.8 medium
References
Original description
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
Last activity 26 Oct 2026. Patch Forecast updates every hour.