CVE-2021-25736: Kubernetes

Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Affected products

• Kubernetes Kubernetes: from 1.18.0, before 1.18.18 (fixed in 1.18.18); from 1.19.0, before 1.19.10 (fixed in 1.19.10); from 1.20.0, before 1.20.6 (fixed in 1.20.6)

Published 2023-10-30. Last modified 2026-06-17.