# k8s.io/kubernetes (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/k8s-io-kubernetes Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/k8s-io-kubernetes.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 50 vulnerabilities in k8s.io/kubernetes (Go): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-13281, was published on 14 December 2025. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 50 (0 critical, 0 exploited in the wild) ## About k8s.io/kubernetes (Go) An open-source system for automating deployment, scaling, and management of containerized applications. ## Latest k8s.io/kubernetes (Go) vulnerabilities - [CVE-2025-13281: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass](https://junglewise.ai/threats/cve-2025-13281-kube-controller-manager-is-vulnerable-to-half-blind-server-side) (medium, CVSS 5.8, published 14 Dec 2025) - [CVE-2025-5187: GO-2025-3915 - Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-5187-kubernetes-nodes-can-delete-themselves-by-adding-an-ownerreference) (low, CVSS 3.1, published 18 Sep 2025) - [CVE-2025-4563: GO-2025-3774 - Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-4563-kubernetes-allows-nodes-to-bypass-dynamic-resource-allocation) (low, CVSS 3.1, published 28 Jul 2025) - [CVE-2019-11243: GO-2025-3645 - Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11243-kubernetes-did-not-effectively-clear-service-account-credentials) (low, CVSS 3.1, published 5 May 2025) - [CVE-2024-9042: GO-2025-3522 - Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2024-9042-kubernetes-allows-command-injection-affecting-windows-nodes-via) (low, CVSS 3.1, published 25 Mar 2025) - [CVE-2024-7598: GO-2025-3547 - Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2024-7598-kubernetes-kube-apiserver-vulnerable-to-race-condition) (low, CVSS 3.1, published 25 Mar 2025) - [CVE-2025-1767: GO-2025-3521 - Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-1767-kubernetes-gitrepo-volume-inadvertent-local-repository-access) (low, CVSS 3.1, published 25 Mar 2025) - [CVE-2025-0426: GO-2025-3465 - Node Denial of Service via kubelet Checkpoint API in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api) (low, CVSS 3.1, published 3 Mar 2025) - [CVE-2024-10220: GO-2024-3286 - Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2024-10220-kubernetes-kubelet-arbitrary-command-execution) (low, CVSS 3.1, published 27 Nov 2024) - [CVE-2024-0793: GO-2024-3277 - Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2024-0793-kubernetes-nil-pointer-dereference-in-kcm-after-v1-hpa-patch) (low, CVSS 3.1, published 19 Nov 2024) - [CVE-2021-25743: GO-2022-0983 - ANSI escape characters not filtered in kubectl in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25743-kubectl-ansi-escape-characters-not-filtered) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-25735: GO-2022-0907 - Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25735-access-restriction-bypass-in-kube-apiserver) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-25741: GO-2022-0910 - Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25741-files-or-directories-accessible-to-external-parties-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-8555: GO-2022-0890 - Server Side Request Forgery (SSRF) in Kubernetes in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2020-8555-server-side-request-forgery-ssrf-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-25737: GO-2022-0908 - Incomplete List of Disallowed Inputs in Kubernetes in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25737-incomplete-list-of-disallowed-inputs-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2018-1002101: GO-2022-0886 - Kubernetes Arbitrary Command Injection in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2018-1002101-kubernetes-arbitrary-command-injection) (low, CVSS 3, published 21 Aug 2024) - [CVE-2020-8551: Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes](https://junglewise.ai/threats/cve-2020-8551-allocation-of-resources-without-limits-or-throttling-and) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-8558: GO-2022-0885 - Improper Authentication in Kubernetes in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2020-8558-improper-authentication-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2019-11251: GO-2022-0802 - Kubernetes kubectl cp Vulnerable to Symlink Attack in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11251-kubernetes-kubectl-cp-vulnerable-to-symlink-attack) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2019-1002101: GO-2022-0782 - Symlink Attack in kubectl cp in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-1002101-symlink-attack-in-kubectl-cp) (low, CVSS 3, published 21 Aug 2024) - [CVE-2019-11253: GO-2022-0703 - XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11253-xml-entity-expansion-and-improper-input-validation-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-5528: GO-2023-2341 - Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2023-5528-kubernetes-improper-input-validation-vulnerability) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-3955: Kubernetes privilege escalation vulnerability](https://junglewise.ai/threats/cve-2023-3955-kubernetes-privilege-escalation-vulnerability) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-3676: GO-2023-2330 - Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2023-3676-kubernetes-privilege-escalation-vulnerability) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2017-1002102: Kubernetes arbitrary file overwrite](https://junglewise.ai/threats/cve-2017-1002102-kubernetes-arbitrary-file-overwrite) (low, CVSS 3, published 20 Aug 2024) ## Most severe k8s.io/kubernetes (Go) vulnerabilities - [CVE-2021-25736: Kubernetes kube-proxy traffic forwarding error on Windows](https://junglewise.ai/threats/cve-2021-25736-kubernetes-kube-proxy-traffic-forwarding-error-on-windows) (medium, CVSS 5.8, published 30 Oct 2023) - [CVE-2025-13281: kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass](https://junglewise.ai/threats/cve-2025-13281-kube-controller-manager-is-vulnerable-to-half-blind-server-side) (medium, CVSS 5.8, published 14 Dec 2025) - [CVE-2020-8554: Kubernetes traffic interception via unverified ExternalIPs ownership](https://junglewise.ai/threats/cve-2020-8554-kubernetes-traffic-interception-via-unverified-externalips) (medium, CVSS 5, published 8 Feb 2022) - [CVE-2020-8561: Kubernetes kube-apiserver confused deputy in webhook configurations](https://junglewise.ai/threats/cve-2020-8561-kubernetes-kube-apiserver-confused-deputy-in-webhook) (medium, CVSS 4.1, published 21 Sep 2021) - [CVE-2019-11253: GO-2022-0703 - XML Entity Expansion and Improper Input Validation in Kubernetes API server in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11253-xml-entity-expansion-and-improper-input-validation-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-3676: GO-2023-2330 - Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2023-3676-kubernetes-privilege-escalation-vulnerability) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2021-25741: GO-2022-0910 - Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25741-files-or-directories-accessible-to-external-parties-in-kubernetes) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2020-8559: GO-2024-2748 - Privilege Escalation in Kubernetes in k8s.io/apimachinery](https://junglewise.ai/threats/cve-2020-8559-privilege-escalation-in-kubernetes) (low, CVSS 3.1, published 20 May 2024) - [CVE-2021-25735: GO-2022-0907 - Access Restriction Bypass in kube-apiserver in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2021-25735-access-restriction-bypass-in-kube-apiserver) (low, CVSS 3.1, published 21 Aug 2024) - [CVE-2023-5528: GO-2023-2341 - Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2023-5528-kubernetes-improper-input-validation-vulnerability) (low, CVSS 3.1, published 21 Aug 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "k8s.io/kubernetes (Go) vulnerabilities", https://junglewise.ai/threats/technologies/k8s-io-kubernetes, 13 November 2026.