Read the docs
TI-2023-02555 Aliases CVE-2023-2728GHSA-cgcv-5272-97pr

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02157 82nd percentileScored 2026-11-07
Fix Partial k8s.io/kubernetes (Go): 1.27.3, 1.26.6, 1.25.11 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesv1.24.14 – <=; v1.25.0 - v1.25.10; v1.26.0 - v1.26.5; v1.27.0 - v1.27.2—No fix listedCNA
—k8s.io/kubernetes (Go)1.27.0 to before 1.27.31.27.3Patch availableGHSA-cgcv-5272-97pr
—k8s.io/kubernetes (Go)1.26.0 to before 1.26.61.26.6Patch availableGHSA-cgcv-5272-97pr
—k8s.io/kubernetes (Go)1.25.0 to before 1.25.111.25.11Patch availableGHSA-cgcv-5272-97pr
—k8s.io/kubernetes (Go)before 1.24.151.24.15Patch availableGHSA-cgcv-5272-97pr
  • Kubernetes VendorKubernetes Affected v1.24.14 – <=; v1.25.0 - v1.25.10; v1.26.0 - v1.26.5; v1.27.0 - v1.27.2 Fixed in — No fix listed CNA
  • k8s.io/kubernetes (Go) Vendor— Affected 1.27.0 to before 1.27.3 Fixed in 1.27.3 Patch available GHSA-cgcv-5272-97pr
  • k8s.io/kubernetes (Go) Vendor— Affected 1.26.0 to before 1.26.6 Fixed in 1.26.6 Patch available GHSA-cgcv-5272-97pr
  • k8s.io/kubernetes (Go) Vendor— Affected 1.25.0 to before 1.25.11 Fixed in 1.25.11 Patch available GHSA-cgcv-5272-97pr
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.24.15 Fixed in 1.24.15 Patch available GHSA-cgcv-5272-97pr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*up to 1.24.14; 1.25.0 – 1.25.10; 1.26.0 – 1.26.5; 1.27.0 – 1.27.2VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions up to 1.24.14; 1.25.0 – 1.25.10; 1.26.0 – 1.26.5; 1.27.0 – 1.27.2 Vulnerable ·Kubernetes

Remediation

  • Fix · GHSA-cgcv-5272-97pr k8s.io/kubernetes (Go) Fixed in 1.27.3 Advisory →
  • Fix · GHSA-cgcv-5272-97pr k8s.io/kubernetes (Go) Fixed in 1.26.6 Advisory →
  • Fix · GHSA-cgcv-5272-97pr k8s.io/kubernetes (Go) Fixed in 1.25.11 Advisory →
  • Fix · GHSA-cgcv-5272-97pr k8s.io/kubernetes (Go) Fixed in 1.24.15 Advisory →

Red Hat 2 advisories

  • RHSA-2023:5008 Released 2023-10-31 · Red Hat rating Important
    Red Hat build of MicroShift 4.14.0 security update
    • Red Hat OpenShift Container Platform 4.14 microshift-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info-4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 +1
  • RHSA-2023:5009 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.14 openstack-ironic-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-api-1:21.5.0-0.20231002130534.0df5961.el9, openstack-ironic-common-1:21.5.0-0.20231002130534.0df5961.el9 +47
    • Red Hat OpenShift Container Platform 4.14 afterburn-5.4.3-1.rhaos4.14.el9, afterburn-dracut-5.4.3-1.rhaos4.14.el9, bpftool-7.0.0-284.36.1.el9_2 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Ironic content for Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5009
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5008, RHSA-2023:5009
Not affected: 1 product
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2728
  2. 2026-10-03 Alias added: GHSA-cgcv-5272-97pr

References

Advisory 1

Other 11

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences