CVE-2026-76654

mediumpriority · track · 0EPSS 0.004 · 37 %ileDE

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.43% (37th) EPSS

CVSS 5.8 · medium

Is it mine?

8 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-27

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.

cvss

Technical severity, 0–10. One row per scoring source.

5.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.8mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:Nsecondary · jordan@liggitt.netexploitability 1.3 · impact 4

v3.15.3mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-59US

affected products (8)

Products and version ranges known to be affected.

Open Source Kubernetes kubelet <1.34.12all versionscert_bundDE
Open Source Kubernetes kubelet <1.35.9all versionscert_bundDE
Open Source Kubernetes kubelet <1.36.5all versionscert_bundDE
Open Source Kubernetes kubelet <1.37.1all versionscert_bundDE
Open Source Kubernetes≤ kubelet <1.37.1cert_bundDE
Open Source Kubernetes≤ kubelet <1.34.12cert_bundDE
Open Source Kubernetes≤ kubelet <1.35.9cert_bundDE
Open Source Kubernetes≤ kubelet <1.36.5cert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3544Kubernetes (kubelet, kube-controller-manager): Mehrere SchwachstellenDeutsch2026-09-23csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kubernetes ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-10-26modified 2026-10-27

references (3) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan