CVE-2021-25735

FAUCET Score

CVE-2021-25735 is a medium-severity vulnerability in kube-apiserver affecting Kubernetes clusters. It allows node updates to bypass Validating Admission Webhooks, specifically those that deny admission based on a Node object's old state, because the webhook fails to observe certain previous fields. The attack vector is network-based with high privileges required, leading to high impact on integrity and availability (CVSS 6.5). There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 1.18.17CPE match	cpe:2.3:a:kubernetes:kubernetes::::::::
		<= 1.19.9CPE match	cpe:2.3:a:kubernetes:kubernetes::::::::
		<= 1.20.5CPE match	cpe:2.3:a:kubernetes:kubernetes::::::::
		< 1.18.18CPE matchmatch criteria	cpe:2.3:a:kubernetes:kubernetes::::::::
		>= 1.19.0, < 1.19.10CPE matchmatch criteria	cpe:2.3:a:kubernetes:kubernetes::::::::

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.2

Impact Score

5.2

CvssVersion

3.1

Exploit Intelligence

EPSS Score

5.52%

Probability of exploitation in next 30 days

EPSS Percentile

92.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0552 is in the 98th percentile among its peer group of 3,565 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

check_pointpatch availablevia llm_extracted

View patch

chromepatch availablevia llm_extracted

View patch

denopatch availablevia llm_extracted

View patch

github_advisorypatch availablevia nvd_reference

View patch

gopatch availablevia ghsa

Product: k8s.io/kubernetesFixed in: 1.18.18

gopatch availablevia ghsa

Product: k8s.io/kubernetesFixed in: 1.20.6

gopatch availablevia ghsa

Product: k8s.io/kubernetesFixed in: 1.19.10

infiniflowpatch availablevia llm_extracted

View patch

invoiceplanepatch availablevia llm_extracted

View patch

pjsippatch availablevia llm_extracted

View patch

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Platform 4.8Fixed in: openshift-0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8

View patch

vuepatch availablevia llm_extracted

View patch

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift

Vendor Advisories (9)

goGHSA-g42g-737j-qx6jmedium

Access Restriction Bypass in kube-apiserver

May 28, 2021

redhatCVE-2021-25735Moderate

kubernetes: Validating Admission Webhook does not observe some previous fields

Apr 14, 2021

pjsipllm-pjsip-5a8c330cff91837cMEDIUM

Kubernetes Validating Admission Webhook Bypass

Jan 1, 2021

denollm-deno-3b1a0d9c146c0186MEDIUM

Kubernetes Validating Admission Webhook Bypass Vulnerability

chromellm-chrome-559d40b8e423d22f

Validating Admission Webhook does not observe some previous fields

check_pointllm-check_point-9f7171a85b4d7fab

Validating Admission Webhook does not observe some previous fields

infiniflowllm-infiniflow-e289740ad7f45d03

Validating Admission Webhook does not observe some previous fields

vuellm-vue-d141ce7f51264321

Validating Admission Webhook does not observe some previous fields

invoiceplanellm-invoiceplane-28aa501d17791d66MEDIUM

The Kubernetes project recently announced a new security vulnerability, CVE-2021-25735, that could allow node updates to bypass a Validating Admission Webhook.

References

github.com / kubernetes/kubernetes/issues/100096

PatchThird Party Advisory

groups.google.com / g/kubernetes-security-announce/c/FKAGqT4jx9Y

Mailing ListThird Party Advisory