CVE-2021-25738: Code Injection in Kubernetes Java Client
Summary
CVE-2021-25738: Code injection in Kubernetes Java Client. Affects io.kubernetes:client-java versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kubernetes Java Client library, specifically the 'io.kubernetes:client-java' package, is a Maven ecosystem package used for interacting with Kubernetes clusters programmatically. It provides a Java API for managing Kubernetes resources and performing operations on the cluster. This package is commonly used by developers to integrate Kubernetes functionality into their Java applications.
Vulnerability Detail
A code injection vulnerability (CVE-2021-25738) has been identified in the Kubernetes Java Client library. This vulnerability arises when loading specially-crafted YAML files using the library, which can lead to code execution. An attacker could exploit this vulnerability by providing malicious YAML files that contain arbitrary code, which would then be executed within the context of the application using the library. The impact of this vulnerability could be severe, allowing an attacker to execute arbitrary code and potentially gain unauthorized access to the Kubernetes cluster or compromise the host system.
How To Fix
Latest published version: 27.0.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional input validation and sanitization measures when processing YAML files using the Kubernetes Java Client library. This can involve implementing strict parsing and validation rules to ensure that only trusted and expected YAML structures are accepted. However, this workaround may not provide complete protection against all possible attack vectors, and upgrading to the fixed version of the package is strongly recommended.
Conclusion
The code injection vulnerability (CVE-2021-25738) in the Kubernetes Java Client library poses a significant risk to applications utilizing this package. It is crucial for developers to upgrade to the fixed version (11.0.1 or later) of the 'io.kubernetes:client-java' package to mitigate this vulnerability. Additionally, implementing strict input validation and sanitization measures can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.kubernetes:client-java →
FAQ
The vulnerability allows an attacker to execute arbitrary code within the context of the application using the Kubernetes Java Client library. This can lead to unauthorized access to the Kubernetes cluster, compromise of the host system, and potential data breaches or system disruptions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your application's pom.xml file and provides real-time monitoring and alerts for open-source vulnerabilities, including this specific vulnerability in the Kubernetes Java Client library.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in the Kubernetes Java Client library. However, it is important to promptly apply the recommended fix to mitigate the risk of potential future exploits.
While it is strongly recommended to upgrade the 'io.kubernetes:client-java' package to the fixed version, you can implement additional input validation and sanitization measures as a temporary workaround. However, this workaround may not provide complete protection, and upgrading to the fixed version is the most effective way to mitigate the vulnerability.
You can find more information about this vulnerability, including the CVE identifier (CVE-2021-25738), in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-m8wh-mqgf-rr8g/GHSA-m8wh-mqgf-rr8g.json).
Related vulnerabilities
Recent vulnerabilities recorded for io.kubernetes:client-java.
