Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2023-5528

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes kubelet

Default version status: affected

  • v1.28.0 to ≤ v1.28.3affected
  • v1.27.0 to ≤ v1.27.7affected
  • v1.26.0 to ≤ v1.26.10affected
  • 0 to ≤ v1.25.15affected
  • v1.28.4unaffected
  • v1.27.8unaffected
  • v1.26.11unaffected
  • v1.25.16unaffected

References