The Cloud Native Computing Foundation (CNCF) hosts vulnerability disclosures for a focused ecosystem of open-source infrastructure and orchestration projects, prominently including Envoy, Crossplane, SPIRE, and related tooling that are deeply embedded in Kubernetes and cloud-native deployments. CNCF-attributed vulnerabilities skew toward serious outcomes, with an elevated share reaching critical severity, and cluster-level exposure concentrates in weakness classes including resource-consumption flaws, authentication defects, certificate-validation bypasses, and control-flow logic errors that are characteristic of distributed systems and proxy infrastructure. Defenders should monitor this vendor's advisories closely given the foundational role its projects play in container orchestration and service mesh; live severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cncf over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-38495CRITICAL Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does n | Jul 27, 2023 | 9.8 | 26 | NO | NO |
CVE-2020-8659HIGH CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. | Mar 4, 2020 | 7.5 | 26 | NO | NO |
CVE-2020-8661HIGH CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests. | Mar 4, 2020 | 7.5 | 25 | NO | NO |
CVE-2021-27098HIGH In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result | Mar 5, 2021 | 8.1 | 23 | NO | NO |
CVE-2021-27099MEDIUM In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which | Mar 5, 2021 | 6.8 | 20 | NO | NO |
CVE-2020-8664MEDIUM CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with | Mar 4, 2020 | 5.3 | 20 | NO | NO |
CVE-2019-9946HIGH Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used | Apr 2, 2019 | 7.5 | 20 | NO | NO |
Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could crea | Jul 27, 2023 | 2.7 | 12 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cncf.
Media articles that mention a CVE ID that affects a product developed by Cncf — matched by CVE ID, not by vendor name.