Disclosure summary
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
Source-reported weakness categories
CWE-20
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
Microsoft Security Updates (CVRF) · 2025-Mar
Open original source · Updated Aug 17, 2026
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.
Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.
Microsoft maximum product score: 6.5
| Vendor | Product / association | Version / bounds |
|---|---|---|
| Microsoft update guide | azl3 kubernetes 1.30.10-7 on Azure Linux 3.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 kubernetes 1.28.4-18 on CBL Mariner 2.0 | (MSRC status code 3) |
| Microsoft update guide | cbl2 kubernetes 1.28.4-18 on CBL-Mariner 2.0 | (MSRC status code 3) |
Original records & references
- NIST NVD record
- CVE Program record
- msrc.microsoft.com — Vendor advisory
PUBLISHED 2025-09-03T18:31:42-04:00
MODIFIED 2026-08-17T17:46:50-04:00
INGESTED 2026-10-08T12:50:09-04:00