Read the docs
TI-2023-03639 Aliases CVE-2023-3893GHSA-r6cc-7wj7-gfx2

Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.

Why it matters now

EPSS 0.02475 84th percentileScored 2026-11-07
Fix Fixed csi-proxy (Kubernetes): v2.0.0-alpha.1, v1.1.3github.com/kubernetes-csi/csi-proxy/v2 (Go): 2.0.0-alpha.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kubernetescsi-proxyv2.0.0-alpha.0; up to v1.1.2v2.0.0-alpha.1, v1.1.3Patch availableCNA
—github.com/kubernetes-csi/csi-proxy/v2 (Go)2.0.0-alpha.0 to before 2.0.0-alpha.12.0.0-alpha.1Patch availableGHSA-r6cc-7wj7-gfx2
—github.com/kubernetes-csi/csi-proxy (Go)0.1.0-rc1 to before 1.1.31.1.3Patch availableGHSA-r6cc-7wj7-gfx2
—github.com/kubernetes-csi/csi-proxy (Go)before 0.0.0-20230821192013-2523e6674ded0.0.0-20230821192013-2523e6674dedPatch availableGHSA-r6cc-7wj7-gfx2
—github.com/kubernetes-csi/csi-proxy (Go)1.1.3-0 to before 1.1.3-0.20230821192013-2523e6674ded1.1.3-0.20230821192013-2523e6674dedPatch availableGHSA-r6cc-7wj7-gfx2
  • csi-proxy VendorKubernetes Affected v2.0.0-alpha.0; up to v1.1.2 Fixed in v2.0.0-alpha.1, v1.1.3 Patch available CNA
  • github.com/kubernetes-csi/csi-proxy/v2 (Go) Vendor— Affected 2.0.0-alpha.0 to before 2.0.0-alpha.1 Fixed in 2.0.0-alpha.1 Patch available GHSA-r6cc-7wj7-gfx2
  • github.com/kubernetes-csi/csi-proxy (Go) Vendor— Affected 0.1.0-rc1 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-r6cc-7wj7-gfx2
  • github.com/kubernetes-csi/csi-proxy (Go) Vendor— Affected before 0.0.0-20230821192013-2523e6674ded Fixed in 0.0.0-20230821192013-2523e6674ded Patch available GHSA-r6cc-7wj7-gfx2
  • github.com/kubernetes-csi/csi-proxy (Go) Vendor— Affected 1.1.3-0 to before 1.1.3-0.20230821192013-2523e6674ded Fixed in 1.1.3-0.20230821192013-2523e6674ded Patch available GHSA-r6cc-7wj7-gfx2

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:csi_proxy:*:*:*:*:*:*:*:*up to 1.1.2VulnerableKubernetes
cpe:2.3:a:kubernetes:csi_proxy:2.0.0:alpha0:*:*:*:*:*:*2.0.0 alpha0VulnerableKubernetes
  • cpe:2.3:a:kubernetes:csi_proxy:*:*:*:*:*:*:*:* Versions up to 1.1.2 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:csi_proxy:2.0.0:alpha0:*:*:*:*:*:* Versions 2.0.0 alpha0 Vulnerable ·Kubernetes

Remediation

  • Fix · CNA csi-proxy (Kubernetes) Fixed in v2.0.0-alpha.1, v1.1.3
  • Fix · GHSA-r6cc-7wj7-gfx2 github.com/kubernetes-csi/csi-proxy/v2 (Go) Fixed in 2.0.0-alpha.1 Advisory →
  • Fix · GHSA-r6cc-7wj7-gfx2 github.com/kubernetes-csi/csi-proxy (Go) Fixed in 1.1.3 Advisory →
  • Fix · GHSA-r6cc-7wj7-gfx2 github.com/kubernetes-csi/csi-proxy (Go) Fixed in 0.0.0-20230821192013-2523e6674ded Advisory →
  • Fix · GHSA-r6cc-7wj7-gfx2 github.com/kubernetes-csi/csi-proxy (Go) Fixed in 1.1.3-0.20230821192013-2523e6674ded Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3893
  2. 2026-10-03 Alias added: GHSA-r6cc-7wj7-gfx2

References

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences