# Unpatchable Vulnerabilities of Kubernetes: CVE-2021-25740

Tenants able to edit their own EndpointSlice objects can redirect shared ingress/LoadBalancer traffic to other tenants' pods, bypassing network policies.

- Payout: Research
- Severity: medium
- Program: Kubernetes
- Credited: Datadog Security Labs
- Disclosed: 2026-05-21
- CVE: CVE-2021-25740
- Write-up quality: 6/10
- Original: https://securitylabs.datadoghq.com/articles/unpatchable-kubernetes-vulnerabilities-cve-2021-25740/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-unpatchable-kubernetes-vulnerabilities-cve-2021-25740
- Tags: domain:cloud impact:internal-access kind:research platform:threat-intel sev:medium tech:kubernetes technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Kubernetes EndpointSlice/Endpoint objects behind shared ingress or LoadBalancer services
**Root cause:** EndpointSlice objects are namespace-scoped and editable by tenants, but shared ingress/LoadBalancer controllers trust their contents and route traffic to whatever IPs they list, even across namespaces.
**Steps:**
1. Deploy two tenant namespaces each with a service and shared URL-routing load balancer.
2. Confirm attacker tenant can edit EndpointSlice objects in its own namespace.
3. Edit attacker's EndpointSlice to list the victim service's pod IP addresses.
4. Request http://attacker-service via the shared load balancer; traffic is forwarded to victim pods.
**How found:** Reasoning from how Services/EndpointSlices decouple stable identity from pod IPs, combined with multi-tenant clusters where the load balancer must reach all namespaces, revealing that endpoint writers control routing.
**Exploitation:** Attacker with namespace-level write access to EndpointSlice replaces endpoint IPs with victim pod IPs; the shared load balancer, which has network access to both namespaces, forwards attacker requests to the victim application, granting unauthorized network access.
**Insight:** In multi-tenant clusters, any namespace-scoped object a shared controller trusts (EndpointSlice, Endpoint) is a routing pivot: check whether tenants can write objects that privileged shared infrastructure consumes.