CVE-2021-25741: Files or Directories Accessible to External Parties in Kubernetes

k8s.io/kubernetes Updated 02 Oct 2025

Summary

01/11/2021

Disclosed on

CVE-2021-25741

CVE

Yes i

Fix available

High

Severity

8.1

CVSS Score

CVE-2021-25741: Files or Directories Accessible to External Parties in kubernetes. Affects k8s.io/kubernetes across 4 version ranges.

< 1.19.15 >= 1.20.0, < 1.20.11 >= 1.21.0, < 1.21.5 >= 1.22.0, < 1.22.2

Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Also tracked for

kubernetes · Debian:11

The same CVE-2021-25741 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications. It provides a highly scalable and flexible environment for running applications in containers. The vulnerability identified as CVE-2021-25741 allows a user to create a container with subpath volume mounts, enabling unauthorized access to files and directories outside of the volume, including the host filesystem.

Vulnerability Detail

The security issue in Kubernetes arises from the ability to create containers with subpath volume mounts. This allows an attacker to access sensitive files and directories outside of the intended volume, potentially compromising the host filesystem. The vulnerability has a CVSS score of 8.1, indicating a high severity level. Exploitation of this vulnerability could lead to unauthorized access, data leakage, or even complete system compromise. The vulnerability affects versions 0.0.0 to 1.19.15, 1.20.0 to 1.20.11, 1.21.0 to 1.21.5, and 1.22.0 to 1.22.2 of the k8s.io/kubernetes package.

How To Fix

Latest published version: v1.37.1 as of 23 Oct 2026

go get k8s.io/kubernetes@v1.37.1

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.19.15 1.19.15
```
go get k8s.io/kubernetes@v1.19.15
```
>= 1.20.0, < 1.20.11 1.20.11
```
go get k8s.io/kubernetes@v1.20.11
```
>= 1.21.0, < 1.21.5 1.21.5
```
go get k8s.io/kubernetes@v1.21.5
```
>= 1.22.0, < 1.22.2 1.22.2
```
go get k8s.io/kubernetes@v1.22.2
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, users can disable the use of subpath volume mounts in their Kubernetes configurations. This can be achieved by modifying the relevant YAML files to remove any subpath volume mounts. However, this workaround may impact the functionality of certain applications or services that rely on subpath volume mounts. Therefore, it is recommended to apply the official fix by upgrading to the fixed versions of the k8s.io/kubernetes package.

Conclusion

The vulnerability in Kubernetes allows unauthorized access to files and directories outside of the intended volume, potentially compromising the host filesystem. It is crucial to promptly upgrade to the fixed versions of the k8s.io/kubernetes package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for k8s.io/kubernetes →

FAQ

What is Kubernetes?

Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications.

What is the impact of this vulnerability?

The vulnerability allows unauthorized access to files and directories outside of the intended volume, potentially compromising the host filesystem. This can lead to unauthorized access, data leakage, or system compromise.

How can I fix this vulnerability?

To fix this vulnerability, upgrade to the fixed versions of the k8s.io/kubernetes package as recommended.

Are there any workarounds available?

A temporary workaround is to disable the use of subpath volume mounts in Kubernetes configurations. However, this may impact the functionality of certain applications or services.