● Kubernetes Advisory · May 2026

Kubernetes Security Advisory: May 2026 Windows Node Container Escape Triage

Triage of the May 2026 Kubernetes release addressing named pipe impersonation and container host breakout on Windows worker nodes.

Node Security Flaws

Host Escape (Windows)

8.4

CVSS Windows Node

High

Hybrid Fleet Priority

漏洞风险分类与修复裁决

Kubernetes resolved CVE-2024-3177 on Windows worker nodes. Insecure security descriptors on named pipes between the container runtime and host allowed containerized processes to impersonate NT AUTHORITY\SYSTEM.

重点漏洞分类评级矩阵

CVE 编号	核心子系统 / 组件	影响程度	CVSS	是否在野利用？
CVE-2024-3177	kubelet / Windows Runtime	Host Container Escape	8.4 High	YES (In-The-Wild)
CVE-2024-3178	kube-proxy	Firewall Rule Flush DoS	6.1 Medium	No
CVE-2024-3179	CSI Driver Volume Mount	Symlink Traversal	6.9 Medium	No

深度源码剖析

Deep Dive: Kubernetes Windows Node Container Escape Teardown →

Review the Go patch in pkg/kubelet/winstats/winstats.go configuring restrictive Security Descriptors (SDDL) on named pipes.

← 浏览完整安全目录所有平台安全更新 →