products / kube_apiserver

Kubernetes API Server

The Kubernetes API server exposes the control plane REST API. Attestd uses the exact keyword kube-apiserver with NVD keywordExactMatch so CVEs must mention the component by name.

api usage

Querying kube-apiserver

product slugkube_apiserver
version format1.24.0, 1.26.0
bash
curl "https://api.attestd.io/v1/check?product=kube_apiserver&version=1.24.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

kube-apiserver 1.24.0 is affected by CVE-2022-3294 (node proxy address validation bypass allowing authenticated access to secure control plane endpoints). The response shows risk_state: "elevated".

json
{
  "product": "kube_apiserver",
  "version": "1.24.0",
  "supported": true,
  "risk_state": "elevated",
  "risk_factors": [
    "remote_code_execution",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": true,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.75,
  "cve_ids": [
    "CVE-2021-25743",
    "CVE-2021-25749",
    "CVE-2022-3162",
    "CVE-2022-3172",
    "CVE-2022-3294",
    "CVE-2023-2431",
    "CVE-2023-2727",
    "CVE-2023-2728",
    "CVE-2023-3676",
    "CVE-2023-3955",
    "CVE-2023-5528"
  ],
  "cves": null,
  "max_epss": 0.11668,
  "last_updated": "2026-07-24T14:53:58.421530Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}
safe version

Kubernetes API Server 1.26.0 includes the upstream fixes for CVE-2022-3294.

bash
curl "https://api.attestd.io/v1/check?product=kube_apiserver&version=1.26.11" \
  -H "Authorization: Bearer $ATTESTD_KEY"
notable cves

CVE history

CVEDescriptionAffectsCVSS
CVE-2023-5528Windows node privilege escalation via hostPath mount handling.1.27.x8.8
CVE-2023-2727Image policy webhook bypass under certain configurations.1.27.x6.5
CVE-2021-25741Symlink exchange can escape container logs volume.1.19–1.228.1
CVE-2020-8558Node services reachable via localhost binding issue.1.18 and prior8.8
CVE-2019-11247RBAC escalation via API server aggregation layer.1.13–1.158.1
data sources

Shared CPE namespace

All Kubernetes components share the kubernetes:kubernetes CPE namespace in NVD. Attestd applies the CPE gate, then keyword matching scopes results to CVEs that mention kube-apiserver. CVEs affecting multiple components may also appear under kubelet.

related