Tomer Peled

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions prior to 1.29.14 Kubernetes versions prior to 1.30.10 Kubernetes versions prior to 1.31.6 **Description** This issue is a command injection affecting Windows worker nodes via the `/logs` query API. The vulnerability allows attackers to execute arbitrary commands on the host machine. The `pattern` parameter of the NodeLogQuery feature is directly passed to PowerShell without filtering, enabling command injection for any user or service account with GET permissions on `nodes/logs`. Successful exploitation allows execution of commands with SYSTEM privileges on all Windows nodes. **Recommendations** Upgrade Kubernetes to version 1.29.14 or later. Upgrade Kubernetes to version 1.30.10 or later. Upgrade Kubernetes to version 1.31.6 or later.

**Name of the Vulnerable Software and Affected Versions:** Windows versions 7 through 11 (affected versions not specified) **Description:** A spoofing vulnerability exists within the Windows Themes component, potentially allowing attackers to steal NTLM credentials. The vulnerability is related to the handling of file paths to image resources, specifically `BrandImage` or `Wallpaper`, within theme files. Exploitation can occur through simply viewing a malicious file in the file explorer, without requiring the file to be launched or the theme applied. This issue was discovered during the development of a patch for a related spoofing issue. The vulnerability allows attackers to affect the system. **Recommendations:** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in the representation of information by the user interface of the Windows operating system, specifically in the Themes component. This can allow a remote attacker to disclose protected information. The vulnerability can be exploited by viewing malicious theme files, which can lead to the leakage of NTLM credentials. There have been reports of this issue being actively exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kubernetes versions prior to 1.28.4 Kubernetes versions prior to 1.27.8 Kubernetes versions prior to 1.26.11 Kubernetes versions prior to 1.25.16 **Description** A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. The vulnerability is related to insufficient input validation in the in-tree storage plugin for Windows nodes, which can lead to remote code execution with SYSTEM privileges on Windows endpoints. This issue affects Kubernetes clusters that use an in-tree storage plugin for Windows nodes. **Recommendations** For Kubernetes versions prior to 1.28.4, update to version 1.28.4 or later. For Kubernetes versions prior to 1.27.8, update to version 1.27.8 or later. For Kubernetes versions prior to 1.26.11, update to version 1.26.11 or later. For Kubernetes versions prior to 1.25.16, update to version 1.25.16 or later. As a temporary workaround, consider restricting access to the in-tree storage plugin for Windows nodes until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Kubernetes (affected versions not specified) **Description** A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. The vulnerability allows for remote code execution (RCE) on Windows endpoints. An attacker with 'apply' privileges can inject arbitrary code that gets executed on Windows machines with SYSTEM privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.