Bypassing policies imposed by the ImagePolicyWebhook admission plugin
Priority LOW 33CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 2 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01134 66th percentileScored 2026-11-07
Fix Partial k8s.io/kubernetes (Go): 1.27.3, 1.26.6, 1.25.11 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | v1.24.14 – <=; v1.25.0 - v1.25.10; v1.26.0 - v1.26.5; v1.27.0 - v1.27.2 | — | No fix listed | CNA |
| — | k8s.io/kubernetes (Go) | 1.27.0 to before 1.27.3 | 1.27.3 | Patch available | GHSA-qc2g-gmh6-95p4 |
| — | k8s.io/kubernetes (Go) | 1.26.0 to before 1.26.6 | 1.26.6 | Patch available | GHSA-qc2g-gmh6-95p4 |
| — | k8s.io/kubernetes (Go) | 1.25.0 to before 1.25.11 | 1.25.11 | Patch available | GHSA-qc2g-gmh6-95p4 |
| — | k8s.io/kubernetes (Go) | before 1.24.15 | 1.24.15 | Patch available | GHSA-qc2g-gmh6-95p4 |
- Kubernetes VendorKubernetes Affected v1.24.14 – <=; v1.25.0 - v1.25.10; v1.26.0 - v1.26.5; v1.27.0 - v1.27.2 Fixed in — No fix listed CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.27.0 to before 1.27.3 Fixed in 1.27.3 Patch available GHSA-qc2g-gmh6-95p4
- k8s.io/kubernetes (Go) Vendor— Affected 1.26.0 to before 1.26.6 Fixed in 1.26.6 Patch available GHSA-qc2g-gmh6-95p4
- k8s.io/kubernetes (Go) Vendor— Affected 1.25.0 to before 1.25.11 Fixed in 1.25.11 Patch available GHSA-qc2g-gmh6-95p4
- k8s.io/kubernetes (Go) Vendor— Affected before 1.24.15 Fixed in 1.24.15 Patch available GHSA-qc2g-gmh6-95p4
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | up to 1.24.14; 1.25.0 – 1.25.10; 1.26.0 – 1.26.5; 1.27.0 – 1.27.2 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions up to 1.24.14; 1.25.0 – 1.25.10; 1.26.0 – 1.26.5; 1.27.0 – 1.27.2 Vulnerable ·Kubernetes
Remediation
- Fix · GHSA-qc2g-gmh6-95p4 k8s.io/kubernetes (Go) Fixed in 1.27.3 Advisory →
- Fix · GHSA-qc2g-gmh6-95p4 k8s.io/kubernetes (Go) Fixed in 1.26.6 Advisory →
- Fix · GHSA-qc2g-gmh6-95p4 k8s.io/kubernetes (Go) Fixed in 1.25.11 Advisory →
- Fix · GHSA-qc2g-gmh6-95p4 k8s.io/kubernetes (Go) Fixed in 1.24.15 Advisory →
Red Hat 2 advisories
- RHSA-2023:5008 Released 2023-10-31 · Red Hat rating ImportantRed Hat build of MicroShift 4.14.0 security update
- Red Hat OpenShift Container Platform 4.14 microshift-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 +1
- RHSA-2023:5009 Released 2023-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.14.0 security update
- Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
- Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Ironic content for Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5009 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:5008, RHSA-2023:5009 |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2727
- 2026-10-03 Alias added: GHSA-qc2g-gmh6-95p4
References
Advisory 2
Other 10
- https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
- https://github.com/kubernetes/kubernetes/issues/118640
- https://security.netapp.com/advisory/ntap-20230803-0004/
- https://github.com/kubernetes/kubernetes/pull/118356
- https://github.com/kubernetes/kubernetes/pull/118471
- https://github.com/kubernetes/kubernetes/pull/118473
- https://github.com/kubernetes/kubernetes/pull/118474
- https://github.com/kubernetes/kubernetes/pull/118512
- https://github.com/kubernetes/kubernetes
- https://security.netapp.com/advisory/ntap-20230803-0004
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2023-2727 · CVE Program
- CVE-2023-2727 · NVD
- FIRST EPSS
- GHSA-qc2g-gmh6-95p4 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-2727 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences