CVEvulnerability
CVE-2023-3676
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-10-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
Description
A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
Affected configurations
• kubernetes kubernetes (< 1.24.17)
• kubernetes kubernetes (>= 1.25.0 < 1.25.13)
• kubernetes kubernetes (>= 1.26.0 < 1.26.8)
• kubernetes kubernetes (>= 1.27.0 < 1.27.5)
• kubernetes kubernetes (>= 1.28.0 < 1.28.1)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/kubernetes/kubernetes/issues/119339 Exploit, Mitigation, Patch, Third Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231130-0007/ security.netapp.com
- https://github.com/kubernetes/kubernetes/issues/119339 Exploit, Mitigation, Patch, Third Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231130-0007/ security.netapp.com