Local Path Provisioner anfällig für Path Traversal über die Parameter.pathPattern

The core of the vulnerability lies in the improper validation of the parameters.pathPattern parameter within the Rancher Local Path Provisioner. An attacker can craft a malicious Kubernetes StorageClass definition, leveraging path traversal sequences (e.g., ../..) to specify PersistentVolume creation locations outside of the intended directory. This could allow them to overwrite critical system files on the host node, escalate privileges, or gain access to sensitive data. The potential impact extends beyond simple data corruption; successful exploitation could compromise the entire Kubernetes node and potentially lead to cluster-wide breaches. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file system structures to bypass access controls.

Kubernetes clusters utilizing the Rancher Local Path Provisioner are at risk, particularly those with misconfigured storage class definitions or environments where users have the ability to modify storage class parameters. Shared Kubernetes environments and those with legacy storage class configurations are especially vulnerable.

• linux / server:

journalctl -u local-path-provisioner --grep 'pathPattern='

• linux / server:

find /var/lib/kubelet/pods -name '*pathPattern=*'

• generic web: Inspect Kubernetes storage class configurations for unusual or suspicious pathPattern values. Look for patterns that include relative path components (e.g., ../).

1. 2026-02-04Disclosure

   disclosure

1. Reserviert2025-10-24
2. Veröffentlicht2026-02-04
3. Geändert2026-02-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-62878 is to immediately upgrade the Rancher Local Path Provisioner to version 0.0.34 or later. If an immediate upgrade is not feasible due to compatibility concerns or breaking changes, consider implementing stricter Kubernetes NetworkPolicies to restrict access to the Local Path Provisioner service. Additionally, implement robust monitoring and auditing of PersistentVolume creation events to detect any suspicious activity. While a WAF is unlikely to directly address this vulnerability, it can be configured to monitor for unusual StorageClass definitions containing path traversal sequences. After upgrading, verify the fix by attempting to create a PersistentVolume with a malicious pathPattern and confirming that the creation fails with an appropriate error message.