CLEANSTART-2026-DR37290: security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by f...

Q: Which systems are exposed to this issue?

Kubernetes Nodes are exposed when their kubelet read-only HTTP endpoint is unauthenticated and can receive container checkpoint requests.

Q: Does an attacker need credentials to exploit this?

No. The affected kubelet read-only HTTP endpoint is described as unauthenticated, so exploitation does not require authentication.

Q: What is the expected impact of exploitation?

Repeated container checkpoint requests can fill a Node's disk and cause a denial of service on that Node.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-0426

Frequently Asked Questions

Which systems are exposed to this issue?

Kubernetes Nodes are exposed when their kubelet read-only HTTP endpoint is unauthenticated and can receive container checkpoint requests.

Does an attacker need credentials to exploit this?

No. The affected kubelet read-only HTTP endpoint is described as unauthenticated, so exploitation does not require authentication.

What is the expected impact of exploitation?

Repeated container checkpoint requests can fill a Node's disk and cause a denial of service on that Node.

CLEANSTART-2026-DR37290: security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by f...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials to exploit this?

What is the expected impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials to exploit this?

What is the expected impact of exploitation?