Kubernetes vulnerabilities and fixes

CVEs that mention Kubernetes, ranked by priority. 31 tracked.

Kubernetes has 31 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 25. Most recent: 2026-10-23. Highest priority: CVE-2026-56163 (score 63/100).

• CVE-2026-56163 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized atta
• CVE-2026-50516 CRITICAL 9.4 MITIGATE Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privile
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-54680 CRITICAL 9.9 Logging operator automates the deployment and configuration of Kubernetes logging pipelines
• CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
• CVE-2026-73298 HIGH 8.7 The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-ag
• CVE-2026-10059 CRITICAL 9.1 A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller
• CVE-2023-22647 CRITICAL 9.9 UPGRADE An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existi
• CVE-2026-73263 CRITICAL 9.9 Prowler is a cloud security platform
• CVE-2026-62246 HIGH 8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-113788 CRITICAL 9.4 Lagoon is an application delivery platform for Kubernetes
• CVE-2026-10090 CRITICAL 9.0 A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat A
• CVE-2026-114638 HIGH 8.7 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGIN
• CVE-2026-65834 MEDIUM 6.8 Capsule is a multi-tenancy and policy-based framework for Kubernetes
• CVE-2026-71475 MEDIUM 6.8 DOWNGRADE MITIGATE A flaw was found in insights-client
• CVE-2026-16745 HIGH 8.8 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI)
• CVE-2026-113727 HIGH 7.4 OpenChoreo is a developer platform for Kubernetes
• CVE-2026-12564 CRITICAL 9.6 A flaw was found in the AAP Controller's HashiCorp Vault credential plugin
• CVE-2026-49478 HIGH 8.7 Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity
• CVE-2026-18381 HIGH 7.6 MITIGATE A flaw was found in the koku-metrics-operator for Red Hat OpenShift
• CVE-2026-71845 MEDIUM 6.3 DOWNGRADE MITIGATE A flaw was found in insights-client
• CVE-2026-10079 HIGH 8.5 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS)
• CVE-2026-65835 MEDIUM 6.6 Capsule is a multi-tenancy and policy-based framework for Kubernetes
• CVE-2026-112778 HIGH 8.8 UPGRADE Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotat
• CVE-2026-71474 HIGH 7.1 DOWNGRADE MITIGATE A flaw was found in insights-client
• CVE-2026-71846 MEDIUM 6.5 DOWNGRADE MITIGATE A flaw was found in insights-client
• CVE-2026-62845 MEDIUM 4.7 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-115356 MEDIUM 5.4 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Au
• CVE-2026-106487 LOW 3.5 UPGRADE UPGRADE Backstage is an open framework for building developer portals
• CVE-2026-15687 LOW 2.4 A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to c
• CVE-2026-113951 HIGH n/a If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec creden

FAQ

How do I fix Kubernetes vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Kubernetes being exploited right now?

None of the tracked Kubernetes CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Kubernetes CVE should I patch first?

CVE-2026-56163 currently ranks highest (63/100): Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized atta.

← Back to latest CVEs