p PatchFirst

CVE-2023-5528

CVE-2023-5528 · Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

CVSS 7.2 · High · EPSS 4.3%

Published
Updated

Stack: containers

Affected products and versions

  • kubernetes

    Versions
    • ≥ v1.28.0, ≤ v1.28.3: Affected (semver)
    • ≥ v1.27.0, ≤ v1.27.7: Affected (semver)
    • ≥ v1.26.0, ≤ v1.26.10: Affected (semver)
    • ≥ 0, ≤ v1.25.15: Affected (semver)
    • v1.28.4: Not affected
    • v1.27.8: Not affected
    • v1.26.11: Not affected
    • v1.25.16: Not affected

    No fix published

Original sources

Check your server →