products / kube_apiserver
Kubernetes API Server
The Kubernetes API server exposes the control plane REST API. Attestd uses the exact keyword kube-apiserver with NVD keywordExactMatch so CVEs must mention the component by name.
api usage
Querying kube-apiserver
product slug
kube_apiserverversion format
1.24.0, 1.26.0bash
curl "https://api.attestd.io/v1/check?product=kube_apiserver&version=1.24.0" \
-H "Authorization: Bearer $ATTESTD_KEY"kube-apiserver 1.24.0 is affected by CVE-2022-3294 (node proxy address validation bypass allowing authenticated access to secure control plane endpoints). The response shows risk_state: "elevated".
json
{
"product": "kube_apiserver",
"version": "1.24.0",
"supported": true,
"risk_state": "elevated",
"risk_factors": [
"remote_code_execution",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": true,
"patch_available": true,
"fixed_version": null,
"confidence": 0.75,
"cve_ids": [
"CVE-2021-25743",
"CVE-2021-25749",
"CVE-2022-3162",
"CVE-2022-3172",
"CVE-2022-3294",
"CVE-2023-2431",
"CVE-2023-2727",
"CVE-2023-2728",
"CVE-2023-3676",
"CVE-2023-3955",
"CVE-2023-5528"
],
"cves": null,
"max_epss": 0.11668,
"last_updated": "2026-07-24T14:53:58.421530Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}safe version
Kubernetes API Server 1.26.0 includes the upstream fixes for CVE-2022-3294.
bash
curl "https://api.attestd.io/v1/check?product=kube_apiserver&version=1.26.11" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-5528 | Windows node privilege escalation via hostPath mount handling. | 1.27.x | 8.8 |
CVE-2023-2727 | Image policy webhook bypass under certain configurations. | 1.27.x | 6.5 |
CVE-2021-25741 | Symlink exchange can escape container logs volume. | 1.19–1.22 | 8.1 |
CVE-2020-8558 | Node services reachable via localhost binding issue. | 1.18 and prior | 8.8 |
CVE-2019-11247 | RBAC escalation via API server aggregation layer. | 1.13–1.15 | 8.1 |
data sources
Shared CPE namespace
All Kubernetes components share the kubernetes:kubernetes CPE namespace in NVD. Attestd applies the CPE gate, then keyword matching scopes results to CVEs that mention kube-apiserver. CVEs affecting multiple components may also appear under kubelet.
related