What’s Vulnerable › Vulnerabilities

CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-06 · updated 2026-06-17
• Weakness: CWE-372

Description

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

Affected products

• Kubernetes: before 1.18.18; from 1.19.0 before 1.19.10; from 1.20.0 before 1.20.6 — fixed in 1.18.18, 1.19.10, 1.20.6

How to fix

Upgrade to a fixed version: Kubernetes 1.18.18, 1.19.10, 1.20.6. Check the vendor advisory for mitigations.

References

• https://github.com/kubernetes/kubernetes/issues/100096
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y
• https://github.com/kubernetes/kubernetes/issues/100096
• https://groups.google.com/g/kubernetes-security-announce/c/FKAGqT4jx9Y

Get alerted when CVE-2021-25735 or the next vulnerability affects your stack