CVE-2026-76654: 
NixOS vulnerability analysis and mitigation

CVE-2026-76654 is a symlink-based NTLM coercion vulnerability in Kubernetes affecting Windows nodes, where kubelet fails to reject symlinked subPath targets that resolve to attacker-controlled UNC network shares. This causes kubelet to transparently authenticate over NTLM, exposing the node's NetNTLMv2 hash to an attacker who can then crack or relay it to impersonate the node if it is domain-joined. The CVE was inserted into threat intelligence feeds on September 23, 2026, and is estimated to be HIGH severity (Feedly, oss-sec).

The root cause is improper validation of symbolic link targets during subPath volume mount processing on Windows nodes (CWE-59: Improper Link Resolution Before File Access). When a container specifies a subPath that is a symlink pointing to a UNC path (e.g., \\attacker-host\share), kubelet on Windows resolves the symlink without sanitizing or rejecting UNC targets, triggering an automatic NTLM authentication handshake to the attacker-controlled SMB server. Exploitation requires the ability to create or influence a Pod definition with a crafted subPath value on a Windows node (Kubernetes Issue, oss-sec).

Successful exploitation allows an attacker to capture the kubelet service account's NetNTLMv2 hash, which can be subjected to offline brute-force cracking or used in NTLM relay attacks. If the Windows node is domain-joined, a successful relay attack could allow the attacker to impersonate the node within the Active Directory environment, enabling lateral movement, privilege escalation, or access to other domain resources. The confidentiality and integrity of the cluster and potentially the broader Windows domain are at risk (Feedly).

As of the available data, no public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported. The CVE status remains "Reserved" and no EPSS score or CISA KEV catalog entry has been identified. However, the attack technique (UNC path coercion via symlinks) is well-understood and commonly used in Windows environments, lowering the bar for exploitation by threat actors with Pod creation privileges (Feedly, oss-sec).

1. Reconnaissance: Identify Kubernetes clusters with Windows nodes where the attacker has permissions to create or modify Pod specifications (e.g., via a compromised namespace or misconfigured RBAC).
2. Set up attacker-controlled SMB server: Deploy a server (e.g., using Responder or Impacket's smbserver.py) on an attacker-controlled host to capture incoming NTLM authentication attempts.
3. Craft malicious Pod spec: Create a Pod definition that mounts a volume with a subPath value that is a symlink resolving to a UNC path pointing to the attacker's SMB server (e.g., \\<attacker-ip>\share).
4. Deploy the Pod to a Windows node: Submit the Pod to the Kubernetes API server, ensuring it is scheduled on a Windows node (e.g., using nodeSelector or tolerations).
5. Capture NetNTLMv2 hash: When kubelet processes the subPath, it resolves the symlink and initiates an NTLM authentication to the attacker's SMB server, exposing the kubelet's NetNTLMv2 hash.
6. Crack or relay the hash: Use tools like Hashcat to crack the captured hash offline, or relay it using Impacket's ntlmrelayx.py to authenticate to other services and impersonate the node, particularly if it is domain-joined (oss-sec, Kubernetes Issue).

• Network: Outbound SMB (TCP 445) connections from Windows Kubernetes nodes to unexpected external or internal IP addresses; NTLM authentication attempts originating from the kubelet process to non-standard SMB servers.
• Logs: Kubernetes audit logs showing Pod creation with subPath values containing UNC-style paths or unusual symlink references; kubelet logs showing errors or access attempts to \\<ip>\<share> style paths.
• Process: Unusual network connections initiated by the kubelet.exe process on Windows nodes to SMB endpoints outside the cluster network.
• File System: Presence of symlinks within volume mount directories on Windows nodes that resolve to UNC paths rather than local filesystem locations (oss-sec).

Users should apply the Kubernetes patch addressing this issue as soon as it becomes available for their cluster version. As an interim workaround, restrict Pod creation permissions via RBAC to trusted users only, preventing untrusted actors from submitting Pod specs with arbitrary subPath values. Additionally, consider blocking outbound SMB traffic (TCP 445) from Windows nodes at the network perimeter to prevent NTLM coercion even if a malicious Pod is deployed. Monitoring Kubernetes audit logs for suspicious subPath values is also recommended (Kubernetes Issue, Kubernetes Advisory).

The vulnerability was discussed in the Kubernetes community forum and on the oss-security mailing list shortly after disclosure. Coverage appeared in cloud-native newsletters such as Last Week in Kubernetes Development and Cloud Native Now, indicating moderate community awareness. No major vendor statements beyond the Kubernetes project advisory have been identified at this time (LWKD, Cloud Native Now).