// LIVE

INTELCritical Citrix NetScaler memory flaw actively exploited in attacks

INTELTelnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach

INTELStorm Brews Over Critical, No-Click Telegram Flaw

INTELFTC Action Against Match and OkCupid for Deceiving Users, Sharing Personal Data

INTELTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Com

INTELHealthcare IT Platform CareCloud Probing Potential Data Breach

INTELSecurity updates for Monday

INTEL'When intelligence and trust move together, AI stops being an experiment and sta

INTELRussian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

INTELDisclosure of Replay Attack Vulnerability in Signed References

INTELHackers now exploit critical F5 BIG-IP flaw in attacks, patch now

INTELTelnyx Targeted in Growing TeamPCP Supply Chain Attack

CVE(Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Out-Of-Bounds Write Remote Code

CVEZDI-26-204: Canon imageCLASS MF654Cdw XPS Parser Vulnerability

CVEZDI-26-202: QNAP TS-453E Hyper Data Protector Plugin SQL Injection RCE Vulnerabi

INTELCritical Citrix NetScaler memory flaw actively exploited in attacks

INTELTelnyx joins LiteLLM in latest PyPI package poisoning tied to Trivy breach

INTELStorm Brews Over Critical, No-Click Telegram Flaw

INTELFTC Action Against Match and OkCupid for Deceiving Users, Sharing Personal Data

INTELTeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Com

INTELHealthcare IT Platform CareCloud Probing Potential Data Breach

INTELSecurity updates for Monday

INTEL'When intelligence and trust move together, AI stops being an experiment and sta

INTELRussian APT Star Blizzard Adopts DarkSword iOS Exploit Kit

INTELDisclosure of Replay Attack Vulnerability in Signed References

INTELHackers now exploit critical F5 BIG-IP flaw in attacks, patch now

INTELTelnyx Targeted in Growing TeamPCP Supply Chain Attack

CVE(Pwn2Own) Canon imageCLASS MF654Cdw TTF Parsing Out-Of-Bounds Write Remote Code

CVEZDI-26-204: Canon imageCLASS MF654Cdw XPS Parser Vulnerability

CVEZDI-26-202: QNAP TS-453E Hyper Data Protector Plugin SQL Injection RCE Vulnerabi

INTELLIGENCE SOURCE: Kubernetes Blog · 2026-03-25

Kubernetes v1.35 Brings Improved Security for CSI Drivers

— min read

·

GENERATED BY aria-32b

·

VIA Kubernetes Blog

#kubernetes #csi #security #service-account-tokens #volume-context

◎

ARIA ANALYSIS aria-32b · 2026-03-25

In Kubernetes v1.35, CSI drivers can now opt-in to receive service account tokens through the 'secrets' field in 'NodePublishVolumeRequest', improving security by addressing accidental logging issues in volume context.

TL;DR

In Kubernetes v1.35, CSI drivers can now opt-in to receive service account tokens through the 'secrets' field in 'NodePublishVolumeRequest', improving security by addressing accidental logging issues in volume context.

What happened

Kubernetes version 1.35 introduces an opt-in feature for CSI (Container Storage Interface) drivers, allowing them to request and receive service account tokens via a secrets field, rather than the volume context where sensitive information might be accidentally logged.

Why it matters for ops

This update enhances security by preventing accidental logging of service account tokens in gRPC requests. It aligns with the CSI specification's intended use for storing sensitive data securely and simplifies driver maintenance by standardizing token handling practices.

Action items

Implement fallback logic to check both volume context and secrets field for tokens
Upgrade kube-apiserver and kubelet to version 1.35 or later
Deploy updated CSI driver with opt-in feature

Source link

https://kubernetes.io/blog/2026/01/07/kubernetes-v1-35-csi-sa-tokens-secrets-field-beta/

// SOURCES

Kubernetes Blog — Original article ↗