NTLM Coercion Vulnerability in Windows Nodes Affects Kubernetes
CVE-2026-76654

5.8MEDIUM

Key Information:

Vendor

Kubernetes
Status
Kubernetes
Vendor
CVE Published:
26 October 2026

What is CVE-2026-76654?

An NTLM coercion vulnerability affects Windows nodes in Kubernetes due to the mishandling of symbolic links in volumeMounts. When a pod specifies a symbolic link that points to an attacker-controlled network share, the kubelet attempts to authenticate to this share using NTLM without proper validation of the linked path. This could lead to the exposure of the NetNTLMv2 hash of the kubelet's operating account, allowing attackers to potentially crack passwords or impersonate the node in domain-joined environments.

Affected Version(s)

Kubernetes v1.34.0

Kubernetes v1.35.0

Kubernetes v1.36.0

References

https://github.com/kubernetes/kubernetes/issues/142098
issue-tracking
https://groups.google.com/g/kubernetes-security-announce/...
mailing-list

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kubernetes Third-Party Security Audit subproject, OSTIF, and Shielder
.