QwikSec

Security Database

CVE

CWE

Training

CVE-2023-2728

Published: Jul 3, 2023

Modified: Feb 13, 2025

PUBLISHED

CVSS v3.1

6.5

MEDIUM

Description

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

Vendor	Product	Versions
Kubernetes	Kubernetes	affected `v1.24.14 - <= <=` affected `v1.25.0 - v1.25.10` affected `v1.26.0 - v1.26.5` affected `v1.27.0 - v1.27.2`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

References

https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8

mailing-list

https://github.com/kubernetes/kubernetes/issues/118640

issue-tracking

http://www.openwall.com/lists/oss-security/2023/07/06/3

https://security.netapp.com/advisory/ntap-20230803-0004/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2023-2728 | MEDIUM (6.5) - Security Vulnerability | QwikSec