Bug 2526745 (CVE-2026-76654)

Summary: CVE-2026-76654 kubelet: kubelet: Subpath symlinking on Windows nodes permits NTLM coercion
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Kubernetes kubelet on Windows nodes. When kubelet resolves a volume subPath that is a symbolic link, it does not reject an ordinary UNC network path. Following that link causes Windows to authenticate to the remote share with NTLM, exposing the NetNTLMv2 hash of the kubelet account. That hash may be cracked or, if the node is domain-joined, used in an NTLM relay.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-09-15   

Description OSIDB Bzimport 2026-09-01 12:08:10 UTC 
A flaw was found in kubernetes. On Windows nodes, kubelet evaluates symbolic links when preparing a pod volume subPath. That check is supposed to refuse device and UNC targets so Windows does not open a network path while resolving the link. The implementation only matches extended device prefixes (\\?\, \\.) and the stripped UNC form, so an ordinary UNC target such as \\server\share is treated as a local path and followed.

If an attacker can create a pod that is scheduled onto a Windows node and whose volume subPath is a symbolic link to an attacker-controlled SMB share, kubelet follows the link. Windows then starts an SMB session and sends the NetNTLMv2 hash of the account under which kubelet is running (typically the node computer account when the node is domain-joined). The attacker can try to crack that hash or, with additional NTLM-relay conditions, impersonate the node.

This code is Windows-only (pkg/volume/util/subpath/subpath_windows.go). Linux kubelet is not built with it. In Red Hat OpenShift, the Windows kubelet is the kubelet.exe that Windows Machine Config Operator (WMCO) installs on Windows workers, not the Linux kubelet on RHCOS nodes. Clusters with no Windows nodes are not affected.