Technical impact
The vulnerability allows a pod’s volumeMount subPath to point to a symbolic link that resolves to an attacker‑controlled UNC share. On Windows nodes the kubelet follows the symlink without rejecting a UNC target, and Windows performs NTLM authentication to the share. This results in the kubelet leaking the NetNTLMv2 hash of the service account under which it runs. The weakness is a reference to external resources (CWE‑59). The impact is that an attacker can obtain the salt‑hashed credential, which may be cracked or relayed to impersonate the node if it is domain‑joined. The CVSS score of 5.8 indicates moderate severity.
Affected Systems
Kubernetes kubelet processes running on Windows nodes are affected. No version restriction is explicitly listed, implying that any Windows kubelet that allows subPath resolution without the recent UNC validation may be vulnerable.
Risk and Exploitability
EPSS is not available and the CVE is not listed in the CISA KEV catalog. The likely attack vector is an adversary who can create or modify pod specifications to include a subPath symlink to a malicious UNC share. The attacker must have network connectivity from the Windows node to the share and rely on Windows NTLM authentication. Proper RBAC that limits pod creation privileges and network segmentation that blocks outbound share access reduce the exploitation likelihood. The CVSS score of 5.8 indicates moderate severity, but the stolen hash could be valuable for credential cracking or relay attacks within a domain.
