The issue affects Kubernetes kubelets running on Windows nodes. Exposure requires a pod volumeMount subPath that resolves through a symbolic link to an attacker-controlled UNC network share.
An attacker must be able to supply a pod volumeMount subPath using a symbolic link that points to their network share. The published CVSS vector rates required privileges as High and attack complexity as High.
The kubelet may attempt NTLM authentication to the attacker-controlled share, disclosing the NetNTLMv2 hash for the account running kubelet. An attacker may attempt to crack that hash or relay it to impersonate the node if the node is domain-joined.
Check Windows-node kubelet versions. The advisory lists affected versions as kubelet 1.34.11 and earlier, 1.35.8 and earlier, 1.36.4 and earlier, and 1.37.0.
Upgrade kubelet to a fixed version. The fix makes kubelet refuse UNC symlink targets on Windows; the advisory identifies kubelet 1.34.12 and later as fixed.