Kubernetes Official CVE Feed

rest.AnonymousClientConfig() does not remove the serviceaccount credentials from config created by rest.InClusterConfig()

`kubectl --http-cache=<world-accessible dir>` creates world-writeable cached schema files

json-patch requests can exhaust apiserver resources

proxy request handling in kube-apiserver can leave vulnerable TCP connections

smb mount security issue

Kubectl copy doesn't check for paths outside of it's destination directory.

atomic writer volume handling allows arbitrary file deletion in host filesystem

subpath volume mount handling allows arbitrary file access in host filesystem

Azure PV should be Private scope not Container scope

PodSecurityPolicy admission plugin authorizes incorrectly