Kubernetes must remove old components after updated versions have been installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242442	CNTR-K8-002700	SV-242442r1188293_rule	CCI-002617	medium
Description
Previous versions of Kubernetes components that are not removed after updates have been installed may be exploited by adversaries by allowing the vulnerabilities to still exist within the cluster. It is important for Kubernetes to remove old pods when newer pods are created using new images to always be at the desired security state.
STIG			Date
Kubernetes Security Technical Implementation Guide			2026-02-12

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

VPM-05.5Removal of Previous Versions

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SI-2(6)Removal of Previous Versions of Software and Firmware

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-002617

1.00

DISA STIG Benchmark (XCCDF)V2R6intersects(normalised)

Details

Check Text (C-242442r1188293_chk)

To view all pods and the images used to create the pods, from the Control Plane, run the following command: kubectl get pods --all-namespaces -o jsonpath="{..image}" | \ tr -s '[[:space:]]' '\n' | \ sort | \ uniq -c Review the images used for pods running within Kubernetes. If there are multiple versions of the same image, this is a finding.

Fix Text (F-45675r863906_fix)

Remove any old pods that are using older images. On the Control Plane, run the command: kubectl delete pod podname (Note: "podname" is the name of the pod to delete.)