CVE-2021-25737

    Dashboard / Vulnerabilities / CVE-2021-25737

    CVE-2021-25737

    Published: 6 Sept 2021Last Modified: 7 Aug 2026

    Summary:

    Details: A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

    References: https://groups.google.com/g/kubernetes-security-announce/c/xAiN3924thY, https://security.netapp.com/advisory/ntap-20211004-0004/, https://github.com/kubernetes/kubernetes/issues/102106

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 250a1838aa2c492c9096ff86558515b8639d7e87
    Fixed -d0d3bc6b038cb8f886d5cf3c175bffc0cb1dbf00

    Affected versions

    1.21.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25737 | CVE-DB