Loading vulnerability…
CVE-2021-25741 is a high-severity Kubernetes vulnerability in kubelet’s handling of subPath volume mounts. A user who can create a Pod/container using a subPath volume mount may be able to exploit symlink traversal behavior so that the mounted path resolves outside the intended volume boundary. As a result, Kubernetes can mount files or directories other than the requested subpath, including locations on the host filesystem, into the container. The issue is described as similar to other symlink traversal flaws in volume-mount handling and stems from improper restriction of path resolution for subPath mounts.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a standalone Zig proof-of-concept/educational exploit for CVE-2021-25741, modeling the Kubernetes kubelet subPath TOCTOU symlink race as a local filesystem race rather than a full Kubernetes exploit chain. The codebase is small and focused: src/main.zig is the CLI entry point and orchestrator; src/setup.zig creates a test directory tree and sentinel files; src/racer.zig runs a tight renameat2(RENAME_EXCHANGE) loop to atomically swap a real directory and a symlink; src/victim.zig simulates the vulnerable kubelet behavior by checking 'target' with fstatat(..., AT_SYMLINK_NOFOLLOW), optionally sleeping, then opening 'target/secret.txt' with either vulnerable openat or protected openat2; src/syscalls.zig defines raw syscall wrappers and constants for openat2, RESOLVE_* flags, and RENAME_EXCHANGE; src/stats.zig tracks wins/losses/errors/ELOOP blocks. Exploit capability: the program demonstrates a local symlink race where validation and use are separated. The racer thread converts 'target' between a legitimate directory and a symlink to 'symlink_target'. The victim thread may validate 'target' as a directory, then later open through the same path after it has been swapped to a symlink, causing it to read 'PWNED' instead of 'LEGIT'. This is a concrete demonstration of the core primitive behind the kubelet vulnerability. In mitigation mode, the same path open is performed with openat2 plus RESOLVE_NO_SYMLINKS|RESOLVE_BENEATH, causing the kernel to reject the symlink traversal with ELOOP/XDEV rather than follow it. There are no network callbacks, C2 endpoints, remote URLs used by the executable logic, or external services contacted by the exploit itself. The only fingerprintable runtime targets are local filesystem paths under the working directory, defaulting to /tmp/race-workdir. The repository includes build metadata (build.zig, build.zig.zon), documentation, and project metadata files, but the actual exploit logic is entirely in the Zig source files under src/. Overall, this is a real local exploit demonstration with a hardcoded payload and clear educational purpose, not a detection script and not a fake exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.