● Kubernetes Advisory · September 2026

Kubernetes Security Advisory: September 2026 Kube-apiserver Auth Triage

Triage of the Kubernetes September 2026 release addressing authorization bypasses in aggregated API servers and cluster RBAC desyncs.

3
Cluster Vulnerabilities
1
Auth Bypass (RBAC)
8.1
CVSS apiserver
Critical
Cluster Admin Action

セキュリティトリアージとリスク評価

The Kubernetes Security Response Committee resolved CVE-2024-5321 in kube-apiserver. Aggregated API endpoints mishandled cluster-scoped authorization tokens, enabling users with namespace-limited rights to execute cluster-admin actions.

優先脆弱性トリアージマトリックス

CVE識別番号 対象サブシステム / コンポーネント 影響範囲 CVSS ゼロデイ悪用確認？
CVE-2024-5321kube-apiserver / RBACCluster Authorization Bypass8.1 HighYES (In-The-Wild)
CVE-2024-5322kube-controller-managerDenial of Service6.5 MediumNo
CVE-2024-5323etcd Client ProtocolToken Leak5.8 MediumNo
注目ソースコード分析

Deep Dive: Kubernetes kube-apiserver Authorization Bypass Teardown →

Analyze the Go patch in staging/src/k8s.io/apiserver/pkg/endpoints/request/context.go enforcing strict namespace boundary checks.

← セキュリティディレクトリ一覧 すべてのセキュリティ更新情報 →