{"schema_version":"1.9.0","id":"CVE-2023-5528","published":"2023-11-14T20:32:08.411Z","modified":"2026-08-12T03:51:14.757428162Z","aliases":["GHSA-hq6q-c2x6-hmch","GO-2023-2341"],"related":["CGA-9757-28v5-j7rp","openSUSE-SU-2025:15424-1"],"summary":"Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation","details":"A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/kubelet","events":[{"introduced":"0"},{"fixed":"e5e8c2b2f912d4676373464f023bc3495de84965"},{"introduced":"202e223fff3b2425eb941c13ff02e10b8e11a568"},{"fixed":"f4abc565d0e9a0d5e0ab2ff26e1f1288619fa982"},{"introduced":"bc4c2f36af4e19e04b0d09b6fe4d101916a504fb"},{"fixed":"2c99be4ef5a00bf98aa70fc4c1bdc798b91a33a0"},{"introduced":"64c8471fa33c114d66df8f2efc02789f07449c63"},{"fixed":"22d719d7b45cd9fcea2cc318dce0f28567ed0e0d"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8.0"},{"fixed":"1.25.16"},{"introduced":"1.26.0"},{"fixed":"1.26.11"},{"introduced":"1.27.0"},{"fixed":"1.27.8"},{"introduced":"1.28.0"},{"fixed":"1.28.4"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"0b9efaeb34a2fc51ff8e4d34ad9bc6375459c4a4"},{"fixed":"c5f43560a4f98f2af3743a59299fb79f07924373"},{"introduced":"b46a3f887ca979b1a5d14fd39cb1af43e7e5d12d"},{"fixed":"3cd242c51317aed8858119529ccab22079f523b1"},{"introduced":"1b4df30b3cdfeaba6024e81e559a6cd09a089d65"},{"fixed":"66fee42707cd7f5a89f1987f7cb81b02dd19161c"},{"introduced":"855e7c48de7388eb330da0f8d9d2394ee818fb8d"},{"fixed":"bae2c62678db2b5053817bc97181fcc2e8388103"}],"database_specific":{"cpe":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.8.0"},{"fixed":"1.25.16"},{"introduced":"1.26.0"},{"fixed":"1.26.11"},{"introduced":"1.27.0"},{"fixed":"1.27.8"},{"introduced":"1.28.0"},{"fixed":"1.28.4"}],"source":"CPE_RANGE"}}],"versions":["kubernetes-1.9.0-alpha.3","kubernetes-1.9.0-alpha.2","kubernetes-1.9.0-alpha.1","kubernetes-1.9.0-alpha.0","kubernetes-1.13.0-alpha.0","kubernetes-1.12.0-beta.0","kubernetes-1.12.0-alpha.1","kubernetes-1.12.0-alpha.0","kubernetes-1.11.0-alpha.2","kubernetes-1.11.0-alpha.1","kubernetes-1.11.0-alpha.0","kubernetes-1.10.0-alpha.3","kubernetes-1.10.0-alpha.2","kubernetes-1.10.0-alpha.1","kubernetes-1.10.0-alpha.0","v1.26.10","v1.28.3","v1.27.7","v1.26.9","v1.28.2","v1.27.6","v1.28.1","v1.26.8","v1.27.5","v1.28.0","v1.26.7","v1.27.4","v1.26.6","v1.27.3","v1.27.2","v1.26.5","v1.27.1","v1.26.4","v1.27.0","v1.26.3","v1.26.3-rc.0","v1.26.2","v1.26.2-rc.0","v1.26.1","v1.26.1-rc.0","v1.26.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-5528.json"}}],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5528.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5528"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240119-0009/"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/121879"},{"type":"PACKAGE","url":"https://github.com/kubernetes/kubernetes"},{"type":"ARTICLE","url":"https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA"}],"database_specific":{"cna_assigner":"kubernetes","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5528.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}