Read the docs
TI-2023-03674 Aliases CVE-2023-3955GHSA-q78c-gwqw-jcmc

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03776 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kubelet (Kubernetes): v1.28.1, v1.27.5, v1.26.8 +2k8s.io/kubernetes (Go): 1.28.1, 1.27.5, 1.26.8 +2Red Hat: 5 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kuberneteskubeletv1.28.0; v1.27.0 – v1.27.4; v1.26.0 – v1.26.7; v1.25.0 – v1.25.12; up to v1.24.16v1.28.1, v1.27.5, v1.26.8, v1.25.13, v1.24.17Patch availableCNA
—k8s.io/kubernetes (Go)1.28.0 to before 1.28.11.28.1Patch availableGHSA-q78c-gwqw-jcmc
—k8s.io/kubernetes (Go)1.27.0 to before 1.27.51.27.5Patch availableGHSA-q78c-gwqw-jcmc
—k8s.io/kubernetes (Go)1.26.0 to before 1.26.81.26.8Patch availableGHSA-q78c-gwqw-jcmc
—k8s.io/kubernetes (Go)1.25.0 to before 1.25.131.25.13Patch availableGHSA-q78c-gwqw-jcmc
—k8s.io/kubernetes (Go)before 1.24.171.24.17Patch availableGHSA-q78c-gwqw-jcmc
  • kubelet VendorKubernetes Affected v1.28.0; v1.27.0 – v1.27.4; v1.26.0 – v1.26.7; v1.25.0 – v1.25.12; up to v1.24.16 Fixed in v1.28.1, v1.27.5, v1.26.8, v1.25.13, v1.24.17 Patch available CNA
  • k8s.io/kubernetes (Go) Vendor— Affected 1.28.0 to before 1.28.1 Fixed in 1.28.1 Patch available GHSA-q78c-gwqw-jcmc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.27.0 to before 1.27.5 Fixed in 1.27.5 Patch available GHSA-q78c-gwqw-jcmc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.26.0 to before 1.26.8 Fixed in 1.26.8 Patch available GHSA-q78c-gwqw-jcmc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.25.0 to before 1.25.13 Fixed in 1.25.13 Patch available GHSA-q78c-gwqw-jcmc
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.24.17 Fixed in 1.24.17 Patch available GHSA-q78c-gwqw-jcmc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*before 1.24.17; 1.25.0 to before 1.25.13; 1.26.0 to before 1.26.8; 1.27.0 to before 1.27.5; 1.28.0 to before 1.28.1VulnerableKubernetes
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.24.17; 1.25.0 to before 1.25.13; 1.26.0 to before 1.26.8; 1.27.0 to before 1.27.5; 1.28.0 to before 1.28.1 Vulnerable ·Kubernetes
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA kubelet (Kubernetes) Fixed in v1.28.1, v1.27.5, v1.26.8, v1.25.13, v1.24.17
  • Fix · GHSA-q78c-gwqw-jcmc k8s.io/kubernetes (Go) Fixed in 1.28.1 Advisory →
  • Fix · GHSA-q78c-gwqw-jcmc k8s.io/kubernetes (Go) Fixed in 1.27.5 Advisory →
  • Fix · GHSA-q78c-gwqw-jcmc k8s.io/kubernetes (Go) Fixed in 1.26.8 Advisory →
  • Fix · GHSA-q78c-gwqw-jcmc k8s.io/kubernetes (Go) Fixed in 1.25.13 Advisory →
  • Fix · GHSA-q78c-gwqw-jcmc k8s.io/kubernetes (Go) Fixed in 1.24.17 Advisory →

Red Hat 5 advisories

  • RHSA-2023:7515 Released 2023-11-27 · Red Hat rating Important
    Red Hat OpenShift for Windows Containers 9.0.0 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator, openshift4/windows-machine-config-operator-bundle
  • RHSA-2023:4885 Released 2023-08-30 · Red Hat rating Important
    Red Hat OpenShift support for Windows Containers 8.0.2 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-rhel9-operator
  • RHSA-2023:4835 Released 2023-08-29 · Red Hat rating Important
    Red Hat OpenShift support for Windows Containers 5.1.2 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4-wincw/windows-machine-config-rhel8-operator
Show 2 more Red Hat advisories
  • RHSA-2023:4780 Released 2023-08-28 · Red Hat rating Important
    Red Hat OpenShift support for Windows Containers 6.0.2 security update
    • Red Hat OpenShift Container Platform 4.11 openshift4-wincw/windows-machine-config-rhel8-operator
  • RHSA-2023:4777 Released 2023-08-28 · Red Hat rating Important
    Red Hat OpenShift support for Windows Containers 7.1.1 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:4835
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:4780
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:4777
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:4885
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:7515
Not affected: 4 products
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3955
  2. 2026-10-03 Alias added: GHSA-q78c-gwqw-jcmc
  3. 2026-11-01 EPSS moved to the 50th–90th percentile
  4. 2026-11-07 EPSS moved to the 90th–95th percentile

References

Exploit 1

Advisory 1

Other 15

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences