Security Advisories · k3s-io/k3s · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

K3s apiserver port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack
GHSA-m4hf-6vgr-75r2 published Sep 8, 2023 by cwayne18

High
K3S bootstrap data is encrypted with empty string if user does not supply a token
GHSA-cxm9-4m6p-24mc published Jul 23, 2021 by davidnuzik

Moderate