Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kubernetes/apiserver
master @ 61371f4
91
Fixes
0
CVEs
CRITICAL
Peak severity
43.3%
Coverage
Highlights
Auth Bypass: 37 prior fixes. Scrutinize any change in this area.
plugin/pkg/authenticator/token/oidc/oidc.go: most-fixed (5 issues). Treat as high-risk during review.
55 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes target the same dispatcher, indicating a fragile dry-run check and missing returns that can allow webhook bypass. The incomplete fix (dc1d8e70) shows a guard was added but not enforced, a classic asymmetry risk.
Auth Bypass: OIDC authenticator has multiple distinct bypasses: empty username from CEL, JSON-serialized JWT acceptance, and audience/issuer validation gaps. These indicate insufficient input validation on token claims and parsing paths.
Auth Bypass: Unsafe delete option bypasses admission and finalizers; authorization check added but collection delete still vulnerable. This is a sibling-path issue where the guard on single delete was not applied to collection delete.