VEX / emissary-apiext

emissary-apiext

4 بيانات, صدرت في 2026-10-05.كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

@id https://quench-works.com/vex/emissary-apiext/2026-10-05

1. CVE-2024-9042

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • kubernetes v1.30.3

   emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's node log query handler (pkg/kubelet) on Windows nodes.

2. CVE-2025-0426

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • kubernetes v1.30.3

   emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's checkpoint API (pkg/kubelet).

3. CVE-2025-13281

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • kubernetes v1.30.3

   emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-controller-manager's Portworx volume plugin (pkg/volume/portworx).

4. CVE-2025-5187

   غير متأثر · الشيفرة المعرّضة غير موجودة
   • kubernetes v1.30.3

   emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-apiserver's NodeRestriction admission plugin (plugin/pkg/admission/noderestriction).