UpHeron
All vulnerabilities

Servers and applications

CVE-2021-25737

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

Severity
Medium 4.8
Published
6 Sept 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.18.19, 1.19.10, 1.20.7
Sources
NVD

Affected software

SoftwareAffected versions
KubernetesServers and applications · cpe:a:kubernetes:kubernetes
  • From 1.16.0 before 1.18.19
  • From 1.19.0 before 1.19.10
  • From 1.20.0 before 1.20.7
  • Version 1.21.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-25737
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-25737