Read the docs
TI-2023-04979 Aliases CVE-2023-5408GHSA-7664-m5hw-r7q8

Openshift: modification of node role labels

Priority LOW 37CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01512 74th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat OpenShift Container Platform 4.11—v4.11.0-202311211130.p0.g7021090.assembly.streamPatch availableCNA
Red HatRed Hat OpenShift Container Platform 4.12—v4.12.0-202311021630.p0.gfe5e2a1.assembly.streamPatch availableCNA
Red HatRed Hat OpenShift Container Platform 4.13—v4.13.0-202310210425.p0.gd525f5d.assembly.streamPatch availableCNA
Red HatRed Hat OpenShift Container Platform 4.14—v4.14.0-202310201027.p0.g8b38d12.assembly.streamPatch availableCNA
  • Red Hat OpenShift Container Platform 4.11 VendorRed Hat Affected — Fixed in v4.11.0-202311211130.p0.g7021090.assembly.stream Patch available CNA
  • Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in v4.12.0-202311021630.p0.gfe5e2a1.assembly.stream Patch available CNA
  • Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in v4.13.0-202310210425.p0.gd525f5d.assembly.stream Patch available CNA
  • Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in v4.14.0-202310201027.p0.g8b38d12.assembly.stream Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*4.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*4.12VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*4.13VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:*4.14VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:* Versions 4.13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

  • RHSA-2023:7479 Released 2023-11-29 · Red Hat rating Important
    OpenShift Container Platform 4.11.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-disk-csi-driver-rhel8-operator, openshift4/ose-cluster-config-operator +28
  • RHSA-2023:6842 Released 2023-11-16 · Red Hat rating Important
    OpenShift Container Platform 4.12.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/oc-mirror-plugin-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-disk-csi-driver-rhel8-operator +9
  • RHSA-2023:5006 Released 2023-10-31 · Red Hat rating Important
    OpenShift Container Platform 4.14.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
Show 1 more Red Hat advisories
  • RHSA-2023:6130 Released 2023-10-30 · Red Hat rating Important
    OpenShift Container Platform 4.13.19 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-alibaba-cloud-csi-driver-container-rhel8, openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +44

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:7479
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:6842
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:6130
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:5006
Not affected: 4 products
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5408
  2. 2026-10-03 Alias added: GHSA-7664-m5hw-r7q8

References

Advisory 6

Other 1

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
See all 340 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences