CVE catalog

CVE-2023-5528

kubernetes: CVE-2023-5528

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Nov 14, 2023, 4:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 4.09% · Oct 25, 2026

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	kubernetes	sid	`1.36.4+ds-1`	not affected
Debian	kubernetes	forky	`1.36.4+ds-1`	not affected
Debian	kubernetes	trixie	`1.32.3+ds-2`	not affected
Debian	kubernetes	bookworm	`1.20.5+really1.20.2-1.1+deb12u1`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	kubernetes	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	kubernetes	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	kubernetes	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	kubernetes	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]