Kubernetes — PoC Archivehttps://poc.intelseclab.com/tags/kubernetes/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000IngressNightmare: Kubernetes ingress-nginx Admission Controller Shared-Library Injection RCE (CVE-2025-1974)https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-06_cve-2025-1974-ingressnightmare-nginx-admission-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974. Status: Weaponized. Affects: Kubernetes ingress-nginx admission controller. Tags: kubernetes, ingress-nginx, ingressnightmare, admission-controller, nginx, ssl-engine, shared-library-injection, cluster-secrets, docker, python, c, cwe-94.cloudCriticalkubernetesingress-nginxingressnightmareadmission-controllernginxssl-engineshared-library-injectioncluster-secretsdockerpythonccwe-94OS Command Injection in KubeAI via Model URL (CVE-2026-34940)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-34940-kubeai-ollama-command-injection/High severity (CVSS 8.7) — cloud · CVE-2026-34940. Status: PoC. Affects: KubeAI (github.com/kubeai-project/kubeai). Tags: kubernetes, kubeai, command-injection, ollama, crd, kubectl, model-serving, cwe-78.cloudHighkuberneteskubeaicommand-injectionollamacrdkubectlmodel-servingcwe-78Kubernetes `runAsNonRoot` Bypass via UID Integer Overflow (CVE-2026-46680)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-46680-k8s-runasnonroot-uid-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-46680-k8s-runasnonroot-uid-overflow/High severity — cloud · CVE-2026-46680. Status: PoC. Affects: Kubernetes (kubelet / container runtime UID handling). Tags: kubernetes, container-escape, runasnonroot, uid-overflow, security-context-bypass, privilege-escalation.cloudHighkubernetescontainer-escaperunasnonrootuid-overflowsecurity-context-bypassprivilege-escalationApache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/High severity — cloud · CVE-2026-40564. Status: PoC. Affects: Apache flink-kubernetes-operator. Tags: ssrf, kubernetes, flink, operator, kubernetes-operator, jarURI, cloud-metadata, crd.cloudHighssrfkubernetesflinkoperatorkubernetes-operatorjarURIcloud-metadatacrdIngressNightmare - Kubernetes Ingress-NGINX Unauthenticated RCEhttps://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-05-17_ingressnightmare-k8s-ingress-nginx-rce/Critical severity (CVSS 9.8) — cloud · CVE-2025-1974 (primary); also CVE-2025-1097, CVE-2025-1098, CVE-2025-24514. Status: Weaponized. Affects: Kubernetes Ingress-NGINX Controller (ingress-nginx). Tags: RCE, Kubernetes, ingress-nginx, admission-controller, unauthenticated, nginx-config-injection, cluster-takeover, k8s, shared-object, reverse-shell.cloudCriticalRCEKubernetesingress-nginxadmission-controllerunauthenticatednginx-config-injectioncluster-takeoverk8sshared-objectreverse-shell