CVE-2023-1260
Kube-apiserver: privesc
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Kube-apiserver: privesc
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
- Record
CVE-2023-1260- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2023-2468
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
- Record
EUVD-2023-2468- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92hx-3mh6-hc49
kube-apiserver authentication bypass vulnerability
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
- Record
GHSA-92hx-3mh6-hc49- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
- Record
CVE-2023-1260- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVGHSA-92hx-3mh6-hc49
kube-apiserver authentication bypass vulnerability
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
- Record
GHSA-92hx-3mh6-hc49- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVRHSA-2023:3976
Red Hat Security Advisory: OpenShift Container Platform 4.12.24 packages and security update
- Record
RHSA-2023:3976- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2023:4093
Red Hat Security Advisory: OpenShift Container Platform 4.13.5 security update
- Record
RHSA-2023:4093- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:4312
Red Hat Security Advisory: OpenShift Container Platform 4.11.46 security update
- Record
RHSA-2023:4312- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:4898
Red Hat Security Advisory: OpenShift Container Platform 4.10.67 security update
- Record
RHSA-2023:4898- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:5008
Red Hat Security Advisory: Red Hat build of MicroShift 4.14.0 security update
- Record
RHSA-2023:5008- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- kubernetes kube-apiserver
- red hat openshift container platform 4
- red hat openshift container platform 4.10
- red hat openshift container platform 4.11
- red hat openshift container platform 4.12
- red hat openshift container platform 4.13
- red hat openshift container platform 4.14
- redhat openshift container platform
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/openshift/apiserver-library-goGo |
before 0.0.0-20230621 | 0.0.0-20230621 |
openshiftRed Hat:openshift:4.12::el8 |
before 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.12::el8 |
before 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8 |
openshiftRed Hat:openshift:4.12::el9 |
before 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
openshift-hyperkubeRed Hat:openshift:4.12::el9 |
before 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 | 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9 |
openshiftRed Hat:openshift:4.13::el8 |
before 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.13::el8 |
before 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8 |
openshiftRed Hat:openshift:4.13::el9 |
before 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 |
openshift-hyperkubeRed Hat:openshift:4.13::el9 |
before 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 | 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9 |
openshift-clientsRed Hat:openshift:4.13::el8 |
before 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshift-clients-redistributableRed Hat:openshift:4.13::el8 |
before 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8 |
openshift-clientsRed Hat:openshift:4.13::el9 |
before 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 |
openshift-clients-redistributableRed Hat:openshift:4.13::el9 |
before 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 | 0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9 |
openshiftRed Hat:openshift:4.11::el8 |
before 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.11::el8 |
before 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 | 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8 |
openshiftRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 |
before 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 |
before 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 | 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8 |
microshiftRed Hat:openshift:4.14::el9 |
before 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
microshift-networkingRed Hat:openshift:4.14::el9 |
before 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
microshift-release-infoRed Hat:openshift:4.14::el9 |
before 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
microshift-selinuxRed Hat:openshift:4.14::el9 |
before 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 | 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-1260 is a high vulnerability (CVSS 8.0) in Kubernetes Kube-apiserver, published September 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in github.com/openshift/apiserver-library-go 0.0.0-20230621.
References
access.redhat.com/errata/RHSA-2023:3976
Show 139 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2176267
github.com/advisories/GHSA-92hx-3mh6-hc49
security.netapp.com/advisory/ntap-20231020-0010
nvd.nist.gov/vuln/detail/CVE-2023-1260
docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3976.json
cve.org/CVERecord?id=CVE-2023-1260
go.dev/issue/58975
groups.google.com/g/golang-announce/c/Xdv6JL9ENs8
issues.redhat.com/browse/OCPBUGS-10201
vuln.go.dev/ID/GO-2023-2041.json