{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://quench-works.com/vex/emissary/2026-10-05",
  "author": "QuenchWorks <info@quench-works.com>",
  "timestamp": "2026-10-05T00:00:00Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2024-9042"
      },
      "products": [
        {
          "@id": "pkg:golang/k8s.io/kubernetes@v1.30.3"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's node log query handler (pkg/kubelet) on Windows nodes."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-0426"
      },
      "products": [
        {
          "@id": "pkg:golang/k8s.io/kubernetes@v1.30.3"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is the kubelet's checkpoint API (pkg/kubelet)."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-13281"
      },
      "products": [
        {
          "@id": "pkg:golang/k8s.io/kubernetes@v1.30.3"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-controller-manager's Portworx volume plugin (pkg/volume/portworx)."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-5187"
      },
      "products": [
        {
          "@id": "pkg:golang/k8s.io/kubernetes@v1.30.3"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "emissary-ingress links only API-type and utility packages of k8s.io/kubernetes v1.30.3: apiext links pkg/util/node, busyambassador pkg/apis/{apps,autoscaling,core,core/v1,extensions/v1beta1,networking,networking/v1,networking/v1beta1}, pkg/api/v1/service, pkg/features, pkg/util/node and pkg/util/parsers . Checked with `go list -deps ./cmd/apiext ./cmd/busyambassador` at v4.1.0: no kubelet, volume plugin, controller or admission plugin package is in either build, and the build fails if one is ever linked. The vulnerable code is kube-apiserver's NodeRestriction admission plugin (plugin/pkg/admission/noderestriction)."
    }
  ]
}