The flaw allows kubelet on Windows nodes to follow a subPath that is a symbolic link to a UNC network path without rejecting it. This causes Windows to authenticate to the remote share with NTLM, exposing the NetNTLMv2 hash of the kubelet account. That hash can be cracked or used in a relay attack, compromising the cluster.Security is weakened because the kubelet credentials are exposed, potentially allowing further lateral movement.

Kubernetes kubelet running on Windows nodes is vulnerable. The issue has no version restrictions listed, so any kubelet instance that enables subPath resolution on a Windows node without the added validation may be affected.

The CVSS score of 5.8 denotes moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Attack requires the capability to create or modify pods that use the vulnerable subPath configuration; thus the attacker needs pod creation privileges or the ability to influence pod specifications. The exploitation path involves directing kubelet to resolve a symlink pointing to a UNC share, after which Windows performs NTLM authentication and leaks the hash. Proper RBAC controls and network segmentation reduce the likelihood of successful exploitation.