https://seclists.org/oss-sec/2026/q3/915: [kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Affected Software
Frequently Asked Questions
Which environments are exposed?
The issue affects Kubernetes kubelets running on Windows nodes. Exposure requires a pod volumeMount subPath that resolves through a symbolic link to an attacker-controlled UNC network share.
What does an attacker need to exploit this?
An attacker must be able to supply a pod volumeMount subPath using a symbolic link that points to their network share. The published CVSS vector rates required privileges as High and attack complexity as High.
What is the practical impact if exploitation succeeds?
The kubelet may attempt NTLM authentication to the attacker-controlled share, disclosing the NetNTLMv2 hash for the account running kubelet. An attacker may attempt to crack that hash or relay it to impersonate the node if the node is domain-joined.
How can I determine whether a kubelet is affected?
Check Windows-node kubelet versions. The advisory lists affected versions as kubelet 1.34.11 and earlier, 1.35.8 and earlier, 1.36.4 and earlier, and 1.37.0.
What is the mitigation?
Upgrade kubelet to a fixed version. The fix makes kubelet refuse UNC symlink targets on Windows; the advisory identifies kubelet 1.34.12 and later as fixed.