Security readout for executives and security teams
Plain-English summary
Affected Kubernetes Windows workloads may run with administrator privileges even when configured to require non-root execution. This weakens a safety control that operators may rely on to limit container privileges. Business urgency is highest for clusters running Windows nodes and the listed kubelet versions.
Executive priority
Treat as high priority where Kubernetes Windows nodes exist, especially in multi-tenant or developer-accessible clusters. For Linux-only Kubernetes estates, validate scope and document non-exposure rather than launching broad remediation.
Technical view
CVE-2021-25749 is a kubelet runAsNonRoot logic bypass affecting Kubernetes v1.22.0-1.22.13, v1.23.0-1.23.10, and v1.24.0-1.24.4. Windows containers can run as ContainerAdministrator despite runAsNonRoot=true. CVSS 3.1 is 7.8 with local access and low complexity.
Likely exposure
Exposure is limited to Kubernetes environments using Windows container workloads on affected kubelet versions. Linux-only clusters are not indicated as affected by the provided sources.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The CVSS vector requires local privileges and no user interaction, so risk is tied to users or workloads already able to run pods on affected Windows nodes.
Researcher notes
Evidence is specific to kubelet behavior for Windows containers. The provided data names affected version ranges but does not include exploit details, active exploitation, or exact fixed versions. Keep analysis tied to the Kubernetes advisory and CVE record.
Mitigation direction
- Inventory Kubernetes clusters for affected kubelet versions and Windows nodes.
- Follow Kubernetes advisory guidance for supported fixed kubelet releases.
- Do not rely on runAsNonRoot alone for Windows privilege control on affected nodes.
- Restrict who can deploy Windows workloads until remediation is complete.
- Review workload policies for assumptions about non-root enforcement.
Validation and detection
- Confirm kubelet versions on all Windows Kubernetes nodes.
- Identify Windows workloads setting runAsNonRoot to true.
- Review whether workloads could still run as ContainerAdministrator.
- Check Kubernetes advisory status before closing remediation.
- Document Linux-only clusters as not indicated affected by these sources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-25749 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzACVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.