CVE-2021-25737: Kubernetes

Medium severity, CVSS 4.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

Affected products

• Kubernetes Kubernetes: from 1.16.0, before 1.18.19 (fixed in 1.18.19); from 1.19.0, before 1.19.10 (fixed in 1.19.10); from 1.20.0, before 1.20.7 (fixed in 1.20.7); version 1.21.0 only

Published 2021-09-06. Last modified 2026-06-17.