{"id":"CVE-2021-25737","aliases":["GHSA-mfv7-gq43-w965","GO-2022-0908"],"url":"https://o3.security/vulnerability/CVE-2021-25737","summary":"Incomplete List of Disallowed Inputs in Kubernetes","details":"A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.","published":"2021-09-06T12:15:07.673Z","modified":"2026-08-07T16:50:50.489017Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.18.19"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.19.11"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.20.7"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.21.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://groups.google.com/g/kubernetes-security-announce/c/xAiN3924thY"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20211004-0004/"},{"type":"FIX","url":"https://github.com/kubernetes/kubernetes/issues/102106"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T16:50:50.489017Z"}}