Live › vulnerability › CVE-2026-76654
Go to dashboardOn Windows nodes, a pod's volumeMounts subPath that is a symlink to a UNC network share makes the kubelet authenticate to that share over NTLM. An attacker who controls the share receives the NetNTLMv2 hash of the account running the kubelet, which can be cracked or relayed to impersonate the node.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 23:25 UTC. All times on this page are UTC.
Only Windows nodes running the kubelet are affected, and only when a pod's volumeMounts subPath can resolve to a symlink pointing at an attacker-controlled UNC share. Linux-only clusters and clusters that do not let untrusted workloads create such symlinks are less exposed. The sources do not say which kubelet versions are vulnerable.
No product ranges from the sources yet.
kubelet --versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.
This page as .md · .json · in your agent: get_signal("CVE-2026-76654")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.