A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

This issue has been rated **Medium** ([CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)), and assigned **CVE-2021-25735**.

**Note:** This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

#### Affected Versions

- kube-apiserver v1.20.0 - v1.20.5
- kube-apiserver v1.19.0 - v1.19.9
- kube-apiserver <= v1.18.17

#### Fixed Versions

This issue is fixed in the following versions:
- kube-apiserver v1.21.0 - Fixed by https://github.com/kubernetes/kubernetes/pull/99946
- kube-apiserver v1.20.6 - Fixed by https://github.com/kubernetes/kubernetes/pull/100315
- kube-apiserver v1.19.10 - Fixed by https://github.com/kubernetes/kubernetes/pull/100316
- kube-apiserver v1.18.18 - Fixed by https://github.com/kubernetes/kubernetes/pull/100317

#### Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

CVE-2021-25735: Validating Admission Webhook does not observe some previous fields
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2021-25735: Validating Admission Webhook does not observe some previous fields
Issue date:

--- start body ---
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

This issue has been rated **Medium** ([CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)), and assigned **CVE-2021-25735**.

**Note:** This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

#### Affected Versions

- kube-apiserver v1.20.0 - v1.20.5
- kube-apiserver v1.19.0 - v1.19.9
- kube-apiserver <= v1.18.17

#### Fixed Versions

This issue is fixed in the following versions:
- kube-apiserver v1.21.0 - Fixed by https://github.com/kubernetes/kubernetes/pull/99946
- kube-apiserver v1.20.6 - Fixed by https://github.com/kubernetes/kubernetes/pull/100315
- kube-apiserver v1.19.10 - Fixed by https://github.com/kubernetes/kubernetes/pull/100316
- kube-apiserver v1.18.18 - Fixed by https://github.com/kubernetes/kubernetes/pull/100317

#### Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

--- end body ---

A security vulnerability (CVE-2021-25735) in kube-apiserver allows node updates to bypass a Validating Admission Webhook if the webhook denies admission based on the old state of the Node object. This could lead to unauthorized changes to Node objects, impacting the security and integrity of the Kubernetes cluster.