Skip to content
Fencer Vulns
medium 5.8

CVE-2026-76654 json

Subpath symlinking on Windows nodes permits NTLM coercion

published 2026-10-26 13 d ago modified 2026-11-03 5 d ago also EUVD-2026-110500

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves to a UNC path. As a result, the kubelet will transparently attempt to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running. An attacker could then attempt to crack the hash to retrieve the corresponding password or relay it to impersonate the node, if the node is domain-joined.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-76654 updated cvss 5.8

kubelet: kubelet: Subpath symlinking on Windows nodes permits NTLM coercion

  • Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-operator-bundle
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift for Windows Containers 11.0 openshift4-wincw/windows-machine-config-rhel9-operator 1793279001
    fixed: vendor fix RHSA-2026:94562
  • Red Hat OpenShift for Windows Containers 11.0 openshift4-wincw/windows-machine-config-operator-bundle 1793282060
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 d ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.