[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion

As cited

Copy frozen at 2026-09-24 03:14 UTC (site build).

vulnerabilities

[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion

CVE-2026-76654 affects Kubernetes on Windows nodes when a pod's volumeMounts subPath points to a symbolic link targeting an attacker-controlled network share. The kubelet fails to reject UNC paths during symlink resolution and attempts NTLM authentication to the share, exposing NetNTLMv2 credentials. An attacker can exploit this to obtain credentials through NTLM coercion.

Why it matters: Kubernetes administrators running Windows nodes face credential exposure if pods use symbolic links in volumeMounts; audit pod configurations and restrict network share access until patching is available.

Source published

2026-09-23 23:50 UTC

First seen by Cybersecurity Tracker

2026-09-24 02:32 UTC