CVEvulnerability
CVE-2023-3955
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-10-31
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
Description
A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
Affected configurations
• kubernetes kubernetes (< 1.24.17)
• kubernetes kubernetes (>= 1.25.0 < 1.25.13)
• kubernetes kubernetes (>= 1.26.0 < 1.26.8)
• kubernetes kubernetes (>= 1.27.0 < 1.27.5)
• kubernetes kubernetes (>= 1.28.0 < 1.28.1)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/kubernetes/kubernetes/issues/119595 Exploit, Mitigation, Patch, Third Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E Technical Description
- https://security.netapp.com/advisory/ntap-20231221-0002/ security.netapp.com
- https://github.com/kubernetes/kubernetes/issues/119595 Exploit, Mitigation, Patch, Third Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E Technical Description
- https://security.netapp.com/advisory/ntap-20231221-0002/ security.netapp.com