Is CVE-2026-76654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76654 being exploited in the wild.

How severe is CVE-2026-76654?

Medium severity, with a CVSS score of 5.8, published 26 October 2026.

Which products and versions are affected?

Kubernetes Kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0.

How is CVE-2026-76654 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-76654?

Check whether you run Kubernetes Kubelet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76654: Kubernetes kubelet NTLM coercion via symlink on Windows nodes

Q: Which products and versions are affected?

Kubernetes Kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0.

Q: Is there a fix for CVE-2026-76654?

Yes: fixed in kubelet >= v1.34.12, >= v1.35.9, >= v1.36.5, >= v1.37.1. Until then: Upgrade kubelet to a patched version. Restrict pod creation permissions and audit volumeMounts configurations to prevent use of suspicious symlink paths pointing to network shares. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-76654 · Severity: medium · CVSS 5.8 · Published 2026-10-26

Kubernetes kubelet running on Windows nodes can be tricked into authenticating to attacker-controlled network shares when a pod specifies a symbolic link in its volume mount path. An attacker can capture the kubelet's authentication credentials (NetNTLMv2 hash) and use them to gain access to the node or crack the password. This affects Windows-based Kubernetes deployments where pods have control over volume mount configuration.

Vendors: Kubernetes.

Quick answers

Is CVE-2026-76654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76654 being exploited in the wild.
How severe is CVE-2026-76654?: Medium severity, with a CVSS score of 5.8, published 26 October 2026.
Which products and versions are affected?: Kubernetes Kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0.
Is there a fix for CVE-2026-76654?: Yes: fixed in kubelet >= v1.34.12, >= v1.35.9, >= v1.36.5, >= v1.37.1. Until then: Upgrade kubelet to a patched version. Restrict pod creation permissions and audit volumeMounts configurations to prevent use of suspicious symlink paths pointing to network shares. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76654 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-76654?: Check whether you run Kubernetes Kubelet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: kubelet >= v1.34.12, >= v1.35.9, >= v1.36.5, >= v1.37.1

Upgrade kubelet to a patched version. Restrict pod creation permissions and audit volumeMounts configurations to prevent use of suspicious symlink paths pointing to network shares.

Technical details

A symlink resolution vulnerability in kubelet on Windows fails to reject UNC (Universal Naming Convention) path targets, allowing NTLM authentication coercion. When kubelet mounts a pod volume with a subPath pointing to a symlink that resolves to a network share (e.g., \\attacker.com\share), the kubelet automatically attempts NTLM authentication, exposing the hash of the kubelet's service account. An attacker with ability to create pods or modify pod specifications can exploit this to harvest credentials or perform credential relay attacks on domain-joined nodes.

Affected products

Kubernetes kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.