{"id":"CVE-2023-1260","aliases":["EUVD-2023-2468","GHSA-92hx-3mh6-hc49","RHSA-2023:3976","RHSA-2023:4093","RHSA-2023:4312","RHSA-2023:4898","RHSA-2023:5008"],"status":"published","title":"Kube-apiserver: privesc","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01556,"percentile":0.75535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-288"],"published":"2023-09-24T00:07:08Z","modified":"2026-10-20T10:01:46Z","fixes":[{"ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","fixed_in":["0.0.0-20230621"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"openshift","fixed_in":["0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el8","package":"openshift-hyperkube","fixed_in":["0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el9","package":"openshift","fixed_in":["0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.12::el9","package":"openshift-hyperkube","fixed_in":["0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift","fixed_in":["0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift-hyperkube","fixed_in":["0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","fixed_in":["0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","fixed_in":["0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","fixed_in":["0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","fixed_in":["0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20230621"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/openshift/apiserver-library-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20230621"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.12::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.11::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"microshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"microshift-networking","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"microshift-release-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"microshift-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9"}]}],"bundled":7}],"products":[{"vendor":"kubernetes","product":"kube-apiserver"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.10"},{"vendor":"red hat","product":"red hat openshift container platform 4.11"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:3976","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4093","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4312","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4898","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5008","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1260","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176267","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://github.com/advisories/GHSA-92hx-3mh6-hc49","tags":["x_transferred","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231020-0010/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1260","tags":["advisory"]},{"url":"https://github.com/openshift/apiserver-library-go/commit/a994128188486d2dce99a528fbcc017d276081e0","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231020-0010","tags":["web"]},{"url":"https://github.com/openshift/apiserver-library-go","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3976.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1260","tags":["advisory"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-001","tags":["article"]},{"url":"https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184482","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212085","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4093.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","tags":["advisory"]},{"url":"https://go.dev/issue/58975","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24536","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24536","tags":["advisory"]},{"url":"https://go.dev/issue/59153","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24537","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24537","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24537","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59180","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24538","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59234","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24539","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/59720","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29400","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29400","tags":["advisory"]},{"url":"https://go.dev/issue/59722","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4312.json","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4898.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211348","tags":["report"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10201","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10226","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-10766","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11296","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11374","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11421","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11512","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11538","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11592","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11734","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11829","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-11967","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-12146","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-12736","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-12744","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-12977","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13078","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-13221","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14364","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-14678","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15397","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15740","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-15948","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-16339","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-16392","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-18696","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-18773","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19339","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19423","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19518","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19638","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19646","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19772","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19872","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-19939","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-20059","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-20174","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-6861","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7535","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7779","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7791","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-7874","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8277","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8278","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8301","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8329","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8411","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-8516","tags":["article"]},{"url":"https://issues.redhat.com/browse/OCPBUGS-9996","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5008.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2727","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/118640","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2728","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2728","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39318","tags":["advisory"]},{"url":"https://go.dev/cl/526156","tags":["article"]},{"url":"https://go.dev/issue/62196","tags":["article"]},{"url":"https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2041.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39319","tags":["advisory"]},{"url":"https://go.dev/cl/526157","tags":["article"]},{"url":"https://go.dev/issue/62197","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2043.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39321","tags":["advisory"]},{"url":"https://go.dev/cl/523039","tags":["article"]},{"url":"https://go.dev/issue/62266","tags":["article"]},{"url":"https://vuln.go.dev/ID/GO-2023-2044.json","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39322","tags":["advisory"]},{"url":"https://vuln.go.dev/ID/GO-2023-2045.json","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2023-1260","title":"Kube-apiserver: privesc","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","status":"published","published":"2023-09-24T00:07:08.13Z","modified":"2024-08-02T05:40:59.774Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-2468","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","status":"published","published":"2023-09-24T00:07:08Z","modified":"2024-08-02T05:40:59Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:15.560413Z"}],"ghsa":[{"id":"GHSA-92hx-3mh6-hc49","title":"kube-apiserver authentication bypass vulnerability","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2024-05-03T20:24:52Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2023-1260","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","status":"published","published":"2023-09-24T01:15:42.707Z","modified":"2026-06-17T05:27:29.44Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"GHSA-92hx-3mh6-hc49","title":"kube-apiserver authentication bypass vulnerability","description":"An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions \"update, patch\" the \"pods/ephemeralcontainers\" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2026-05-04T09:00:06.750168469Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"RHSA-2023:3976","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.24 packages and security update","status":"published","published":"2024-09-16T12:24:25Z","modified":"2026-08-07T10:08:57Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4093","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.5 security update","status":"published","published":"2024-09-30T14:49:58Z","modified":"2026-10-16T10:02:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4312","title":"Red Hat Security Advisory: OpenShift Container Platform 4.11.46 security update","status":"published","published":"2024-09-16T12:24:50Z","modified":"2026-08-07T10:09:14Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4898","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.67 security update","status":"published","published":"2024-09-16T12:25:01Z","modified":"2026-08-07T10:09:36Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:5008","title":"Red Hat Security Advisory: Red Hat build of MicroShift 4.14.0 security update","status":"published","published":"2024-09-30T10:02:12Z","modified":"2026-10-20T10:01:46Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"}]}}