CVE-2023-5528
Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
| CWE | CWE-20 |
| Vendor | kubernetes |
| Product | kubelet |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 14, 2023 |
| Last Updated | Feb 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for kubernetes kubelet
Be the first to know when new high vulnerabilities affecting kubernetes kubelet are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Kubernetes / kubelet
v1.28.0 ≤ v1.28.3 v1.27.0 ≤ v1.27.7 v1.26.0 ≤ v1.26.10 0 ≤ v1.25.15
References
github.com: https://github.com/kubernetes/kubernetes/issues/121879 groups.google.com: https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/ lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/ lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/ security.netapp.com: https://security.netapp.com/advisory/ntap-20240119-0009/
Credits
🔍 Tomer Peled