CVE-2023-5408

Openshift: modification of node role labels

State: Published
Severity: 7.2 High
Published: Nov 2, 2023
Updated: Nov 7, 2025
Reserved: Oct 4, 2023

Description

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
Red Hat OpenShift Container Platform 4.11Red Hat	v4.11.0-202311211130.p0.g7021090.assembly.stream and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat	v4.12.0-202311021630.p0.gfe5e2a1.assembly.stream and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	v4.13.0-202310210425.p0.gd525f5d.assembly.stream and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	v4.14.0-202310201027.p0.g8b38d12.assembly.stream and laterNot affected

References

RHSA-2023:5006vendor-advisory
RHSA-2023:6130vendor-advisory
RHSA-2023:6842vendor-advisory
RHSA-2023:7479vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-5408vdb-entry
RHBZ#2242173issue-tracking
https://github.com/openshift/kubernetes/pull/1736

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.