An NTLM coercion vulnerability exists in the Kubernetes kubelet on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When the kubelet resolves symlinks, it does not reject a target that resolves to a UNC path, so it transparently attempts to authenticate to the share using NTLM. This allows an attacker to obtain the NetNTLMv2 hash of the account under which the kubelet is running, which could be cracked or relayed to impersonate the node if it is domain-joined. Affected: kubelet <= v1.34.11, <= v1.35.8, <= v1.36.4, = v1.37.0. Fixed in v1.34.12, v1.35.9, v1.36.5, v1.37.1.