CLEANSTART-2026-FY02366: security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containe...
Security vulnerability affects the nfs-subdir-external-provisioner package. A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/nfs-subdir-external-provisionerto a version that resolves this vulnerability.Fixed in 4.0.2-r4
Event History
Frequently Asked Questions
Which workload types are relevant to this issue?
The issue applies when the envFrom field is populated on regular containers, init containers, or ephemeral containers.
What access would an attacker need to exploit this?
A user would need to be able to launch containers using envFrom. The issue concerns bypassing the mountable-secrets policy enforced by the ServiceAccount admission plugin.
What is the stated impact of successful exploitation?
The provided severity vector indicates low severity with low confidentiality impact and no integrity or availability impact.