CVE-2026-44543
Local Path Provisioner: HelperPod Template Injection
Description
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36.
INFO
Published Date :
May 28, 2026, 5:16 p.m.
Last Modified :
Oct. 26, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the Local Path Provisioner to version 0.0.36.
- Ensure the helperPod.yaml template is properly validated.
- Restrict edit access to the local-path-config ConfigMap.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-44543.
| URL | Resource |
|---|---|
| https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4 | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-44543 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-44543
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-44543 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-44543 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: local-path-provisioner de rancher, Description: Local Path Provisioner proporciona una forma para que los usuarios de Kubernetes utilicen el almacenamiento local en cada nodo. Antes de la versión 0.0.36, un usuario malintencionado con permiso para editar el ConfigMap local-path-config en el espacio de nombres local-path-storage puede manipular la plantilla helperPod.yaml utilizada por rancher/local-path-provisioner. La plantilla helperPod.yaml es cargada por el provisioner y utilizada para crear HelperPods durante las operaciones de aprovisionamiento y limpieza de PVC. Sin embargo, la plantilla no es suficientemente validada antes de su uso. Campos sensibles a la seguridad como securityContext.privileged, volúmenes hostPath y capacidades de Linux pueden ser inyectados en la plantilla. Cuando una operación de PVC desencadena la creación de un HelperPod, el provisioner crea el HelperPod utilizando la plantilla controlada por el atacante. Esto puede resultar en un pod privilegiado ejecutándose en el nodo objetivo con el sistema de archivos raíz del host montado. Esto puede permitir al atacante acceder a archivos sensibles del host, leer tokens de ServiceAccount de otros pods en el mismo nodo, acceder a datos de volumen local-path de otros inquilinos o modificar archivos en el nodo host. Esta vulnerabilidad está corregida en la versión 0.0.36. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'rancher', 'product': 'local-path-provisioner', 'versions': [{'status': 'affected', 'version': '< 0.0.36'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-44543', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-05-30T01:59:44.054722Z'} -
Initial Analysis by [email protected]
Jun. 08, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:suse:local_path_provisioner:*:*:*:*:*:kubernetes:*:* versions up to (excluding) 0.0.36 Added Reference Type GitHub, Inc.: https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4 Types: Mitigation, Vendor Advisory -
New CVE Received by [email protected]
May. 28, 2026
Action Type Old Value New Value Added Description Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC provisioning and cleanup operations. However, the template is not sufficiently validated before use. Security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities can be injected into the template. When a PVC operation triggers HelperPod creation, the provisioner creates the HelperPod using the attacker-controlled template. This can result in a privileged pod running on the target node with the host root filesystem mounted. This may allow the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node. This vulnerability is fixed in 0.0.36. Added CVSS V3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Added CWE CWE-269 Added Reference https://github.com/rancher/local-path-provisioner/security/advisories/GHSA-7fxv-8wr2-mfc4