Skip to content
Fencer Vulns
high 8.8

CVE-2021-25741 json

Symlink Exchange Can Allow Host Filesystem Access

published 2021-09-20 5 y ago modified 2026-09-10 1 mo ago also GHSA-f5f7-6478-qm6p , GO-2022-0910 , EUVD-2021-2339

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.0%
EPSS 8.0% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Patch / fix

  • go k8s.io/kubernetes 1.19.15, 1.20.11, 1.21.5, 1.22.2
  • kubernetes Debian 14, Debian 13, Debian 12 1.20.5+really1.20.2-1

debian advisories DEBIAN-CVE-2021-25741

  • atomic-openshift openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-pod openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-node openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-tests openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-master openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-clients openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-sdn-ovs openshift 3.11 3.11.524-1.git.0.2dffce7.el7
  • atomic-openshift-excluder openshift 3.11 3.11.524-1.git.0.2dffce7.el7

red hat advisories RHSA-2021:3646RHSA-2021:3635RHSA-2021:3642RHSA-2021:3631

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1

opensuse advisories openSUSE-SU-2025:15424-1

  • kubelet Arch Linux 1.22.2-1

arch linux advisories AVG-2393

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-25741 updated cvss 8.8

kubernetes: Symlink exchange can allow host filesystem access

  • Red Hat OpenShift Container Platform 4 openshift4/ose-alibaba-cloud-csi-driver-container-rhel8
    affected: workaround, no fix available “OpenShift Container Platform runs with SELinux in enforcing mode, which reduces the impact of this vulnerability, but does not completely prevent it from being exploited.”
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift 3.11.524-1.git.0.2dffce7.el7, atomic-openshift-pod 3.11.524-1.git.0.2dffce7.el7, atomic-openshift-node 3.11.524-1.git.0.2dffce7.el7, atomic-openshift-tests 3.11.524-1.git.0.2dffce7.el7, atomic-openshift-master 3.11.524-1.git.0.2dffce7.el7, atomic-openshift-clients 3.11.524-1.git.0.2dffce7.el7, +7 more
    fixed: vendor fix “OpenShift Container Platform runs with SELinux in enforcing mode, which reduces the impact of this vulnerability, but does not completely prevent it from being exploited.” RHSA-2021:3646
  • Red Hat OpenShift Container Platform 4.6 openshift 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el7, openshift 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el8, openshift-hyperkube 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el7, openshift-hyperkube 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el8
    fixed: vendor fix “OpenShift Container Platform runs with SELinux in enforcing mode, which reduces the impact of this vulnerability, but does not completely prevent it from being exploited.” RHSA-2021:3642
  • Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el7, openshift 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el8, openshift-hyperkube 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el7, openshift-hyperkube 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el8
    fixed: vendor fix “OpenShift Container Platform runs with SELinux in enforcing mode, which reduces the impact of this vulnerability, but does not completely prevent it from being exploited.” RHSA-2021:3635
  • Red Hat OpenShift Container Platform 4.8 openshift 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el7, openshift 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el8, openshift-hyperkube 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el7, openshift-hyperkube 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el8
    fixed: vendor fix “OpenShift Container Platform runs with SELinux in enforcing mode, which reduces the impact of this vulnerability, but does not completely prevent it from being exploited.” RHSA-2021:3631
  • Red Hat OpenShift Container Platform 3.11 prometheus 3.11.524-1.git.99aae51.el7, openshift-kuryr 3.11.524-1.git.b234b49.el7, openshift-ansible 3.11.524-1.git.0.150f8a9.el7, openshift-kuryr-cni 3.11.524-1.git.b234b49.el7, openshift-kuryr-common 3.11.524-1.git.b234b49.el7, prometheus-alertmanager 3.11.524-1.git.13de638.el7, +21 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.4-2.rhaos4.6.gitea37eea.el7, cri-o 1.19.4-2.rhaos4.6.gitea37eea.el8 Red Hat OpenShift Container Platform 4.8 python-sushy 3.7.3-0.20210804111215.b76050c.el8, python3-sushy 3.7.3-0.20210804111215.b76050c.el8, python3-sushy-tests 3.7.3-0.20210804111215.b76050c.el8, openshift-clients 4.8.0-202109201328.p0.git.88e7eba.assembly.stream.el7, openshift-clients 4.8.0-202109201328.p0.git.88e7eba.assembly.stream.el8, openshift-clients-redistributable 4.8.0-202109201328.p0.git.88e7eba.assembly.stream.el7, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

7.96% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go k8s.io/kubernetes
<1.19.15
>=1.20.0, <1.20.11
>=1.21.0, <1.21.5
>=1.22.0, <1.22.2
1.19.15
1.20.11
1.21.5
1.22.2

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-552 Files or Directories Accessible to External Parties
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.