products / kubelet
Kubernetes kubelet
kubelet runs on each node and starts pods. Attestd uses the keyword kubelet with NVD keywordExactMatch to scope CVEs that mention the node agent.
api usage
Querying kubelet
product slug
kubeletversion format
1.24.0, 1.28.0bash
curl "https://api.attestd.io/v1/check?product=kubelet&version=1.24.0" \
-H "Authorization: Bearer $ATTESTD_KEY"kubelet 1.24.0 is affected by CVE-2023-2431 (seccomp localhost profile bypass allowing pods to run unconfined) and CVE-2022-3294 (shared kubernetes CPE node proxy issue). The response shows risk_state: "elevated".
json
{
"product": "kubelet",
"version": "1.24.0",
"supported": true,
"risk_state": "elevated",
"risk_factors": [
"remote_code_execution",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": true,
"patch_available": true,
"fixed_version": "1.25.16",
"confidence": 0.5,
"cve_ids": [
"CVE-2021-25743",
"CVE-2021-25749",
"CVE-2022-3162",
"CVE-2022-3294",
"CVE-2023-2431",
"CVE-2023-2727",
"CVE-2023-2728",
"CVE-2023-3676",
"CVE-2023-3955",
"CVE-2023-5528"
],
"cves": null,
"max_epss": 0.11668,
"last_updated": "2026-07-26T06:40:42.490416Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}safe version
kubelet 1.28.0 includes the upstream fixes for CVE-2022-3294 and CVE-2023-2431.
bash
curl "https://api.attestd.io/v1/check?product=kubelet&version=1.28.4" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-5528 | Windows node privilege escalation (shared Kubernetes CPE). | 1.27.x | 8.8 |
CVE-2021-25737 | EndpointSlice mirroring bypass under RBAC edge cases. | 1.21.x | 4.8 |
CVE-2020-8557 | Disk exhaustion via container log symlink handling. | 1.18 and prior | 5.5 |
CVE-2019-11245 | Container runAsUser override when image specifies user. | 1.13.x | 7.8 |
CVE-2018-1002105 | API server proxy websocket escalation (also apiserver). | 1.10 and prior | 9.8 |
data sources
Shared CPE namespace
Same as kube-apiserver: kubernetes:kubernetes with keyword kubelet for scoping.
related