CVE-2023-5528: Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-5528?
CVE-2023-5528 is a vulnerability in Kubernetes that allows a user to escalate to admin privileges on Windows nodes.
How does CVE-2023-5528 impact Kubernetes clusters?
Kubernetes clusters are affected if they are using an in-tree storage plugin for Windows nodes.
What is the severity of CVE-2023-5528?
The severity of CVE-2023-5528 is high with a CVSS score of 7.2.
How can I fix CVE-2023-5528?
To fix CVE-2023-5528, update Kubernetes to version 1.25.16, 1.26.11, 1.27.8, or 1.28.4.
Where can I find more information about CVE-2023-5528?
More information about CVE-2023-5528 can be found in the following references: [GitHub](https://github.com/kubernetes/kubernetes/issues/121879), [Google Groups](https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5528).