PT-2021-5366 · Unknown+2 · Kubernetes+1

Fabricio Voznika + 1 · Published 2021-09-15 · Updated 2025-08-08 · CVE-2021-25741

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kubernetes (affected versions not specified)

Description A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. The issue is related to insufficient access control and can be exploited by a remote attacker to bypass security restrictions. The problem is caused by a race condition that allows an attacker to create a symbolic link, giving access from the container to the root of the operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

RCE

Weakness Enumeration

CWE-552

CWE-264

CWE-20

Related Identifiers

ALT-PU-2021-3453

ALT-PU-2021-3547

ALT-PU-2022-1245

BDU:2021-06196

CVE-2021-25741

ELSA-2021-9526

ELSA-2021-9546

GHSA-F5F7-6478-QM6P

GO-2022-0910

OPENSUSE-SU-2025:15424-1

RHSA-2021:3631

RHSA-2021:3635

RHSA-2021:3642

RHSA-2021:3646

Affected Products

Alt Linux

Kubernetes

References · 80

• 🔥 https://github.com/Betep0k/CVE-2021-25741 · Exploit
• 🔥 https://github.com/Glutenfree69/ZigRaceExploit · Exploit
• https://osv.dev/vulnerability/CVE-2021-25741 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-9546.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-9526.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-25741 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-25741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f5f7-6478-qm6p · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-25741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25741 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-25741 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06196 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-25741 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0910 · Vendor Advisory