CVE-2026-44543

Name of the Vulnerable Software and Affected Versions local-path-provisioner versions prior to 0.0.36

Description A malicious user with permissions to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template. This template is used to create HelperPods during PVC provisioning and cleanup operations but is not sufficiently validated before use. An attacker can inject security-sensitive fields such as securityContext.privileged, hostPath volumes, and Linux capabilities into the template. When a PVC operation triggers the creation of a HelperPod, the provisioner uses the attacker-controlled template, potentially resulting in a privileged pod running on the target node with the host root filesystem mounted. This allows the attacker to access sensitive host files, read ServiceAccount tokens from other pods on the same node, access other tenants' local-path volume data, or modify files on the host node.

Recommendations Update to version 0.0.36 or later. Restrict write access to the local-path-config ConfigMap in the local-path-storage namespace to trusted administrators only. Mark the local-path-config ConfigMap as immutable. Enable Kubernetes Pod Security Admission for the local-path-storage namespace by enforcing the baseline policy to prevent the creation of privileged HelperPods.