GHSA-hq6q-c2x6-hmch

Kubernetes Improper Input Validation vulnerability

At a glance

Published: 2023-11-14 21:31 UTC
Updated: 2026-09-10 03:49 UTC
CVE: CVE-2023-5528
Aliases: GO-2023-2341
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Affected packages

Package	Versions
Go · k8s.io/kubernetes	introduced 1.28.0, fixed 1.28.4
Go · k8s.io/kubernetes	introduced 1.27.0, fixed 1.27.8
Go · k8s.io/kubernetes	introduced 1.26.0, fixed 1.26.11
Go · k8s.io/kubernetes	introduced 0, fixed 1.25.16

References

https://nvd.nist.gov/vuln/detail/CVE-2023-5528 ADVISORY
https://github.com/kubernetes/kubernetes/issues/121879 WEB
https://github.com/kubernetes/kubernetes/pull/121881 WEB
https://github.com/kubernetes/kubernetes/pull/121882 WEB
https://github.com/kubernetes/kubernetes/pull/121883 WEB
https://github.com/kubernetes/kubernetes/pull/121884 WEB
https://github.com/kubernetes/kubernetes/pull/121885 WEB
https://github.com/kubernetes/kubernetes PACKAGE
https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4 WEB
https://security.netapp.com/advisory/ntap-20240119-0009 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database