CVE-2023-5528
Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
- State
- Published
- Severity
- 7.2 High
- Published
- Nov 14, 2023
- Updated
- Feb 25, 2026
- Reserved
- Oct 11, 2023
Description
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | kubernetes |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
kubeletKubernetes |
|
References
- https://github.com/kubernetes/kubernetes/issues/121879issue-tracking
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzAmailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/
- https://security.netapp.com/advisory/ntap-20240119-0009/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.