Use this prompt verbatim to generate a security analysis of the current Kubernetes dependency version gaps. Feed it to a capable model (Claude Opus or equivalent) with web access and filesystem access to the kubernetes/kubernetes source tree.
Last updated 2026-07-20: added malformed-compare-URL corrections (grpc→wrong repo, /vN and submodule-path bugs), repo-level security-advisory check (new GHSAs lag OSV/global index), refreshed reference outputs.
You are a Kubernetes security engineer. Your task is to produce a deep, prioritized security analysis of Kubernetes dependency version gaps. Start by fetching the live package list from the Prow CI job, then analyze each package.
-
Fetch the job history page to find the most recent successful run:
https://prow.k8s.io/job-history/gs/kubernetes-ci-logs/logs/ci-kubernetes-e2e-kind-dependenciesFind the first entry with status SUCCESS and extract its job ID from the URL (a large integer, e.g.
2047409810214752256). -
Fetch the differences file directly:
https://storage.googleapis.com/kubernetes-ci-logs/logs/ci-kubernetes-e2e-kind-dependencies/{JOB_ID}/artifacts/differences.md -
Parse the table in that file:
- Skip any row where the first non-whitespace character is
~— those packages are already at latest and need no analysis. - The remaining rows are the packages with version gaps. Each row has:
Package | Current | Latest | URL - The URL column already contains the GitHub compare URL for each package. Use those directly.
- Skip any row where the first non-whitespace character is
-
That parsed list is your complete package table. Count the packages and proceed.
For every package in the list:
-
Fetch the compare URL from the table. Read the full commit list and changed files. Look specifically for:
- Commit messages mentioning CVE, security, panic, overflow, DoS, bypass, injection, race, crash, nil deref, OOB, escape, or auth
- Changes to parsing, serialization, cryptographic, authentication, or network code
- Changes to error-handling paths that previously panicked
- Dependency bumps inside the package's own go.mod (transitive CVE fixes)
-
Check the Go Vulnerability Database at https://pkg.go.dev/vuln/list and https://osv.dev for advisories covering the package in the version range. Also search https://github.com/advisories?query= for GHSA entries. Additionally check repo-level advisories (
gh api repos/<owner>/<repo>/security-advisories) — freshly published GHSAs can take days to propagate to OSV and the global GitHub advisory index, so an OSV-empty result is not proof of a clean range (the 2026-07-20 run found two swag GHSAs published the day before that were repo-level only). -
Check NVD at https://nvd.nist.gov/vuln/search for CVEs mentioning the package.
-
Determine Kubernetes-specific reachability. For each security-relevant change, answer:
- Is this package a direct or indirect dep in the k8s go.mod?
- Which k8s binary uses it: kube-apiserver, kubelet, kube-controller-manager, kube-proxy, kubectl, kubeadm, or only test code?
- Is the vulnerable/fixed code path reachable from untrusted external input (unauthenticated network, authenticated API request body, pod stdout, etc.) or only from trusted/privileged input?
- What is the blast radius if exploited?
Key k8s source locations to grep for reachability:
staging/src/k8s.io/apimachinery/— core API types and serializationstaging/src/k8s.io/apiserver/— kube-apiserver logicstaging/src/k8s.io/client-go/— client librarypkg/— kubelet, controllers, schedulercmd/— binary entrypointstest/— test-only code (not shipped in production binaries)vendor/— check vendor/modules.txt for direct vs indirect
-
Assign a priority:
- CRITICAL — actively exploited or trivially exploitable without authentication, high impact (RCE, auth bypass, data exfiltration)
- HIGH — remotely exploitable by an authenticated user OR exploitable by a lower-privilege actor; significant impact (DoS of core component, data integrity compromise)
- MEDIUM — security-relevant fix but not directly exploitable in standard k8s deployments (e.g., not exploitable because k8s does not use etcd's built-in auth, or fix is in transitive dep k8s already pins), OR correctness fix that affects data integrity on the kube-apiserver storage path
- LOW — defense-in-depth hardening, fix is in test-only code path, or Windows-only, or indirect dep where the attack surface is privileged
- NONE — zero security content; only CI, docs, go directive bumps, or dev tooling changes
Group the packages from your fetched list into tiers and analyze them concurrently with parallel agents:
- Tier 1 (crypto/auth/networking): packages matching
x/crypto,x/net,golang-jwt,go-pathrs,cachecontrol,oauth2 - Tier 2 (storage/infrastructure): packages matching
etcd(all modules together),container-storage-interface,ttrpc,sctp - Tier 3 (serialization/parsing): packages matching
cbor,easyjson,go-openapi,yaml,go-errors - Tier 4 (infra/golang stdlib): packages matching
grpc-gateway,caddy,genproto,x/sys,x/text,x/tools,x/mod,x/time,x/term,x/exp - Tier 5 (lower-risk mixed): everything else
Merge the tier results before writing output.
Produce a single markdown file with this exact structure:
# Kubernetes Dependency Security Analysis
**Date:** <today>
**Prow job:** <job URL used>
**Packages analyzed:** <count of non-~ rows>
**Method:** GitHub diff inspection, [Go Vulnerability Database](https://pkg.go.dev/vuln/list), CVE/GHSA search, K8s source grep for reachability
---
## Executive Summary
<2-3 sentence summary: how many packages need action, how many have no delta, any already-patched CVEs to call out>
---
## Priority 1 — UPGRADE PROMPTLY
<All HIGH/CRITICAL packages, one subsection each>
### [`package/name`](compare-url) vX.Y.Z → vA.B.C
**CVE:** [CVE-XXXX-XXXXX](nvd link) [or "None filed"]
**Type:** <short description>
**Fix commit/PR:** [`shortsha`](full commit url) — "commit message"
**What it does:** <1-2 sentences on the vulnerability>
**K8s reachability (<LOW/MEDIUM/HIGH/VERY HIGH>):**
- <bullet per binary or code path that is affected>
**Attack scenario:** <concrete description of how an attacker would trigger this in a k8s cluster>
**Action:** `./hack/pin-dependency.sh <module> <version>` then `./hack/update-vendor.sh`
---
## Priority 2 — MEDIUM (upgrade in next dep sweep)
<All MEDIUM packages, one subsection each>
## Priority 3 — LOW (batch in next routine dep PR)
<All LOW packages, shorter entries>
## Priority 4 — NONE (no action needed)
<Table of all NONE packages with one-line reason>
| Package | Diff | Reason no action needed |
|---|---|---|
| [`pkg`](compare-url) | vX → vY | <one line> |
---
## Action Plan (ordered)
<Shell commands in priority order using hack/pin-dependency.sh>
---
## CVEs Already Patched (verify current vendor is sufficient)
<Table of CVEs that were already fixed before the current vendor pin>
| CVE | GHSA | Package | Fixed in | Current k8s pin | Status |
|---|---|---|---|---|---|
- Every package name in headers must be a hyperlink to the compare URL from the differences.md table.
- CVE IDs: Link to
https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXXonly after fetching the page to confirm it exists — very new CVEs may be RESERVED and the NVD page will say "CVE ID Not Found." For RESERVED CVEs, link to the upstream issue tracker (e.g.,https://github.com/golang/go/issues/XXXXX) or the GHSA instead. - GHSA IDs: Link to
https://github.com/advisories/GHSA-XXXX-XXXX-XXXX— fetch to verify before linking. - Go vuln IDs (GO-XXXX-XXXX): Link to
https://pkg.go.dev/vuln/GO-XXXX-XXXX— fetch to verify. - PR links: Link to the full GitHub PR URL. Verify the PR number before linking — do not guess.
- Commit SHAs: ALWAYS use the full 40-character SHA, not an abbreviation. Fetch the commit URL to verify it exists before including it. Abbreviated or guessed SHAs are wrong more often than not.
- Vanity compare URLs in the differences.md (e.g.,
https://cyphar.com/go-pathrs/compare/...,https://go.etcd.io/etcd/.../compare/...) redirect to pkg.go.dev, not GitHub diffs. For these, find the real GitHub repo:cyphar.com/go-pathrs→https://github.com/cyphar/libpathrs/compare/go-pathrs%2Fv<OLD>...go-pathrs%2Fv<NEW>go.etcd.io/etcd/*→https://github.com/etcd-io/etcd/compare/<OLD>...<NEW>(one compare covers all etcd sub-modules)- For any other vanity domain, do
go get -v <module>or check the go-import meta tag to find the canonical GitHub repo.
- Malformed GitHub compare URLs in the differences.md — the generator naively appends the Go module path to
github.com/, which breaks whenever module path ≠ repo path. Correct these before fetching (all seen in the 2026-07-20 run):- Wrong repo entirely: the
google.golang.org/grpcrow points atprotocolbuffers/protobuf-go— usehttps://github.com/grpc/grpc-go/compare/v<OLD>...v<NEW>. /vNmajor-version suffix is not a repo path:Masterminds/semver/v3,cpuguy83/go-md2man/v2,fxamacker/cbor/v2→ drop the/vN(e.g.https://github.com/Masterminds/semver/compare/v3.4.0...v3.5.0).- Submodules tag with a path prefix:
containerd/containerd/api→https://github.com/containerd/containerd/compare/api%2Fv<OLD>...api%2Fv<NEW>;google/cadvisor/lib→https://github.com/google/cadvisor/compare/lib%2Fv<OLD>...lib%2Fv<NEW>(if thelib/*tag is missing upstream, fall back to the release tagsv<OLD>...v<NEW>and note it);go-openapi/swag/<sub>submodules are covered by the rootgo-openapi/swagcompare. google.golang.org/genproto/googleapis/{api,rpc}→ both map to one repo:https://github.com/googleapis/go-genproto/compare/<OLD>...<NEW>.
- Wrong repo entirely: the
- go.yaml.in/yaml/v2: The
github.com/go-yaml/yamlrepo may not have newer v2.4.x tags; if the compare 404s, link tohttps://pkg.go.dev/go.yaml.in/yaml/v2?tab=versionsinstead. - OSS-Fuzz URLs (
https://issues.oss-fuzz.com/issues/XXXXXX) are login-gated. Include when you have the real ID; note they require Google login. - Packages with no security content (CI only, go directive bumps, doc fixes) go in the Priority 4 table — do not give them a full subsection.
- Verify k8s reachability by grepping — do not assume a package is used in production just because it appears in go.mod. Check vendor/modules.txt for direct vs indirect. Check whether imports are in
test/vspkg//cmd//staging/. - When a CVE is already fixed in the current k8s vendor pin, call it out in "CVEs Already Patched" — do not list it as something that needs upgrading.
- For etcd CVEs: check whether the upstream advisory says "Kubernetes not affected" (etcd maintainers do this when the CVE requires etcd's built-in RBAC/auth, which k8s bypasses). If so, note it but still recommend upgrading for any data-correctness or linearizability fixes in the same release.
The latest reference output lives in this gist (older runs — 2026-04-23, 2026-06-06 — are in the gist's revision history): https://gist.github.com/dims/e7e55d375149d0c3b4d38f85c8cea172
Key findings from the most recent run, 2026-07-20 (Prow job 2079173402668568576) — use as a sanity check for your methodology:
- MEDIUM:
go-openapi/swagfamily (12 modules) v0.25.4→v0.27.1 — GHSA-xh24-9qpg-8w28 (jsonutils stack-exhaustion DoS) + GHSA-hwp8-w8pv-xq8f (yamlutils billion-laughs), published 2026-07-19 against the then-current pin, repo-level only (absent from OSV/global index on run day); unreachable from untrusted input in k8s (kube-openapi uses only ConcatJSON/name-provider/conv + one struct-gated call), and the bump MVS-forcesjsonpointer v1.0.0 - MEDIUM:
google.golang.org/grpcv1.81.1→v1.82.1 — upstream security release: HTTP/2 control-frame-flood mitigation (grpc/grpc-go#9236, no CVE, no v1.81.x backport) + removal of theGRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKINGkill switch that could re-open CVE-2026-33186 - LOW:
opencontainers/cgroupsv0.0.6→v0.0.7 — eBPF fd-leak fix unreachable twice over (k8s vendors onlydevices/config; kubelet setsSkipDevices: true) - NONE despite scary name:
cyphar/filepath-securejoinv0.6.1→v0.7.0 — entire delta sits behind the//go:build libpathrstag k8s never sets; pure-Go SecureJoin byte-identical - Earlier-run sanity anchors: 2026-04-23 found HIGH
golang.org/x/netCVE-2026-33814 and HIGHfxamacker/cbor/v2v2.9.1 (both since adopted); 2026-06-06 found zero HIGH/MEDIUM and flagged etcd's latest as a do-not-bump pre-release alpha