Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
Priority HIGH 73CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04095 90th percentileScored 2026-11-07
Fix Fixed kubelet (Kubernetes): v1.28.4, v1.27.8, v1.26.11 +1k8s.io/kubernetes (Go): 1.28.4, 1.27.8, 1.26.11 +1Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | kubelet | v1.28.0 – v1.28.3; v1.27.0 – v1.27.7; v1.26.0 – v1.26.10; up to v1.25.15 | v1.28.4, v1.27.8, v1.26.11, v1.25.16 | Patch available | CNA |
| — | k8s.io/kubernetes (Go) | 1.28.0 to before 1.28.4 | 1.28.4 | Patch available | GHSA-hq6q-c2x6-hmch |
| — | k8s.io/kubernetes (Go) | 1.27.0 to before 1.27.8 | 1.27.8 | Patch available | GHSA-hq6q-c2x6-hmch |
| — | k8s.io/kubernetes (Go) | 1.26.0 to before 1.26.11 | 1.26.11 | Patch available | GHSA-hq6q-c2x6-hmch |
| — | k8s.io/kubernetes (Go) | before 1.25.16 | 1.25.16 | Patch available | GHSA-hq6q-c2x6-hmch |
- kubelet VendorKubernetes Affected v1.28.0 – v1.28.3; v1.27.0 – v1.27.7; v1.26.0 – v1.26.10; up to v1.25.15 Fixed in v1.28.4, v1.27.8, v1.26.11, v1.25.16 Patch available CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.28.0 to before 1.28.4 Fixed in 1.28.4 Patch available GHSA-hq6q-c2x6-hmch
- k8s.io/kubernetes (Go) Vendor— Affected 1.27.0 to before 1.27.8 Fixed in 1.27.8 Patch available GHSA-hq6q-c2x6-hmch
- k8s.io/kubernetes (Go) Vendor— Affected 1.26.0 to before 1.26.11 Fixed in 1.26.11 Patch available GHSA-hq6q-c2x6-hmch
- k8s.io/kubernetes (Go) Vendor— Affected before 1.25.16 Fixed in 1.25.16 Patch available GHSA-hq6q-c2x6-hmch
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | 1.8.0 to before 1.25.16; 1.26.0 to before 1.26.11; 1.27.0 to before 1.27.8; 1.28.0 to before 1.28.4 | Vulnerable | Kubernetes |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.8.0 to before 1.25.16; 1.26.0 to before 1.26.11; 1.27.0 to before 1.27.8; 1.28.0 to before 1.28.4 Vulnerable ·Kubernetes
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA kubelet (Kubernetes) Fixed in v1.28.4, v1.27.8, v1.26.11, v1.25.16
- Fix · GHSA-hq6q-c2x6-hmch k8s.io/kubernetes (Go) Fixed in 1.28.4 Advisory →
- Fix · GHSA-hq6q-c2x6-hmch k8s.io/kubernetes (Go) Fixed in 1.27.8 Advisory →
- Fix · GHSA-hq6q-c2x6-hmch k8s.io/kubernetes (Go) Fixed in 1.26.11 Advisory →
- Fix · GHSA-hq6q-c2x6-hmch k8s.io/kubernetes (Go) Fixed in 1.25.16 Advisory →
Red Hat 5 advisories
- RHSA-2024:1203 Released 2024-03-07 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 9.0.1 security update
- Red Hat OpenShift Container Platform 4.14 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator, openshift4/windows-machine-config-operator-bundle
- RHSA-2024:0954 Released 2024-02-27 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 10.15.0 security update
- Red Hat OpenShift Container Platform 4.15 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator
- RHSA-2023:7710 Released 2023-12-11 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 7.2.0 security update
- Red Hat OpenShift Container Platform 4.12 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
Show 2 more Red Hat advisories
- RHSA-2023:7709 Released 2023-12-11 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 8.1.1 security update
- Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel9-operator
- RHSA-2023:7662 Released 2023-12-06 · Red Hat rating ImportantRed Hat OpenShift for Windows Containers 6.0.3 security update
- Red Hat OpenShift Container Platform 4.11 openshift4-wincw/windows-machine-config-operator-bundle, openshift4-wincw/windows-machine-config-rhel8-operator
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2023:7662 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2023:7710 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2023:7709 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:1203 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:0954 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5528
- 2026-10-03 Alias added: GHSA-hq6q-c2x6-hmch
References
Patch 4
- https://github.com/kubernetes/kubernetes/issues/121879
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/
Advisory 2
Other 11
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA
- https://github.com/kubernetes/kubernetes/pull/121881
- https://github.com/kubernetes/kubernetes/pull/121882
- https://github.com/kubernetes/kubernetes/pull/121883
- https://github.com/kubernetes/kubernetes/pull/121884
- https://github.com/kubernetes/kubernetes/pull/121885
- https://github.com/kubernetes/kubernetes
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4
- https://security.netapp.com/advisory/ntap-20240119-0009
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
- TI-2019-08423 Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack CVSS 3.1HIGH 7.5
Sources
- CVE-2023-5528 · CVE Program
- CVE-2023-5528 · NVD
- FIRST EPSS
- GHSA-hq6q-c2x6-hmch · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5528 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences