{"id":"CVE-2026-76654","kind":"vulnerability","aliases":["CVE-2026-76654"],"related":[],"title":"Kubernetes kubelet on Windows leaks NTLM hashes via symlinked subPath","description":"An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.","summary":"On Windows nodes, a pod's volumeMounts subPath that is a symlink to a UNC network share makes the kubelet authenticate to that share over NTLM. An attacker who controls the share receives the NetNTLMv2 hash of the account running the kubelet, which can be cracked or relayed to impersonate the node.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["domain-joined","infrastructure","kubelet","kubernetes","windows"],"not_affected_if":["linux-only-nodes","no-untrusted-workloads"],"how_to_check":"- Check the Kubernetes version on Windows nodes with `kubelet --version`\n- Look for pods on Windows nodes whose volumeMounts use a subPath, and check whether that path can be made a symlink by untrusted users\n- unknown","fix":"- Upgrade the kubelet on Windows nodes to a patched release; the fixed version is unknown from the sources\n- unknown","status":"open","published_at":"2026-10-26T23:17:09+00:00","first_seen_at":"2026-10-26T23:25:48+00:00","triaged_at":"2026-10-26T23:25:59+00:00","updated_at":"2026-10-26T23:25:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T23:25:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the kubelet on Windows nodes to a patched release; the fixed version is unknown from the sources\n- unknown","reach":"network","title":"Kubernetes kubelet on Windows leaks NTLM hashes via symlinked subPath","impact":"medium","summary":"On Windows nodes, a pod's volumeMounts subPath that is a symlink to a UNC network share makes the kubelet authenticate to that share over NTLM. An attacker who controls the share receives the NetNTLMv2 hash of the account running the kubelet, which can be cracked or relayed to impersonate the node.","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","windows","kubelet","domain-joined"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker captures node account NetNTLMv2 hash and may relay it","analyst_note":"Find the affected and fixed kubelet versions and whether pod creation rights are needed to trigger it, using the NVD entry linked in the sources.","how_to_check":"- Check the Kubernetes version on Windows nodes with `kubelet --version`\n- Look for pods on Windows nodes whose volumeMounts use a subPath, and check whether that path can be made a symlink by untrusted users\n- unknown","needs_analyst":true,"not_affected_if":["linux-only-nodes","no-untrusted-workloads"],"who_is_affected":"Only Windows nodes running the kubelet are affected, and only when a pod's volumeMounts subPath can resolve to a symlink pointing at an attacker-controlled UNC share. Linux-only clusters and clusters that do not let untrusted workloads create such symlinks are less exposed. The sources do not say which kubelet versions are vulnerable.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":3436,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-76654':13A,16A 'account':62B,151C 'allow':141C 'attack':51B,104C,143C,159C 'attacker-control':103C 'attempt':132C,162C 'authent':44B,134C 'coercion':78C 'control':53B,105C 'correspond':170C 'could':160C 'crack':69B,164C 'cve':11A,14A 'domain':18B,184C 'domain-join':17B,183C 'exist':80C 'hash':7A,59B,148C,166C 'imperson':73B,176C 'infrastructur':20B 'join':19B,185C 'kubelet':2A,21B,43B,65B,110C,129C,155C 'kubernet':1A,22B 'leak':5A 'link':98C 'make':41B 'netntlmv2':58B,147C 'network':39B,106C 'node':26B,75B,83C,178C,181C 'ntlm':6A,49B,77C,139C 'obtain':145C 'password':171C 'path':124C 'pod':28B,90C 'point':100C 'receiv':56B 'reject':116C 'relay':71B,173C 'resolv':111C,120C 'result':127C 'retriev':168C 'run':63B,157C 'set':94C 'share':40B,47B,55B,107C,137C 'subpath':10A,31B,86C 'suppli':87C 'symbol':97C 'symlink':9A,35B,112C 'target':118C 'transpar':131C 'unc':38B,123C 'use':138C 'via':8A 'volumemount':30B,92C 'vulner':79C 'window':4A,23B,25B,82C","nicknames":[],"mitigations":[],"who_affected":"Only Windows nodes running the kubelet are affected, and only when a pod's volumeMounts subPath can resolve to a symlink pointing at an attacker-controlled UNC share. Linux-only clusters and clusters that do not let untrusted workloads create such symlinks are less exposed. The sources do not say which kubelet versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T23:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"jordan@liggitt.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76654","severity":null,"published_at":"2026-10-26T23:17:09+00:00","modified_at":"2026-10-26T23:17:09+00:00","first_seen_at":"2026-10-26T23:25:48+00:00","fetched_at":"2026-10-26T23:25:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}