See how cncf compares to other vendors in security performance
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0.
A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.
End of life: 10/13/2027, Latest version: 1.40.2
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).
https://github.com/helm/helm/issues/7275 https://www.cncf.io/projects/helm/
A vulnerability was found in Envoy, where using SDS with Combined Validation Context Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
A vulnerability was found in Envoy version 1.13.0 or earlier may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
A vulnerability was found in Envoy version 1.13.0 or earlier may consume excessive amounts of memory when responding internally to pipelined requests.
End of life: 11/6/2026, Latest version: 3.15.1
End of life: 5/16/2027, End of support: 5/15/2027, Latest version: 2.4.2
End of life: 10/28/2027, End of support: 8/28/2027, Latest version: 1.37.2
End of life: 9/30/2026, Latest version: 3.14.0
End of life: 7/14/2027, Latest version: 1.39.6
End of life: 7/31/2027, Latest version: 3.13.5
End of life: 7/9/2026, Latest version: 3.12.0
End of life: 4/30/2028, End of support: 4/30/2028, Latest version: 2.3.7
End of life: 4/23/2027, Latest version: 1.38.9
End of life: 6/28/2027, End of support: 4/28/2027, Latest version: 1.36.6
End of life: 5/14/2026, Latest version: 3.11.3
End of life: 4/8/2026, Latest version: 3.10.0
End of life: 1/13/2027, Latest version: 1.37.11
End of life: 2/17/2026, Latest version: 3.9.1
End of life: 2/28/2027, End of support: 12/28/2026, Latest version: 1.35.10
End of life: 1/9/2026, Latest version: 3.8.1
End of life: 11/6/2026, End of support: 11/6/2026, Latest version: 2.2.10
End of life: 11/26/2025, Latest version: 3.7.3
End of life: 10/14/2026, Latest version: 1.36.13
End of life: 11/2/2025, Latest version: 3.6.0
End of life: 10/27/2026, End of support: 8/27/2026, Latest version: 1.34.13
End of life: 7/23/2026, Latest version: 1.35.13