{"id":"CVE-2023-3027","aliases":["EUVD-2023-43719","GHSA-ffmc-4rrr-xm85"],"status":"published","title":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows...","description":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00198,"percentile":0.09716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-863"],"published":"2023-06-05T00:00:00Z","modified":"2026-06-17T06:13:12Z","products":[{"vendor":"redhat","product":"advanced_cluster_management_for_kubernetes"},{"vendor":"redhat.com","product":"rhacm"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0","tags":["x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3027"},{"url":"https://github.com/advisories/GHSA-ffmc-4rrr-xm85"}],"sources":{"cve":[{"id":"CVE-2023-3027","description":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.","status":"published","published":"2023-06-05T00:00:00Z","modified":"2025-01-08T16:52:25.796Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-43719","description":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.","status":"published","published":"2023-06-05T00:00:00Z","modified":"2025-01-08T16:52:25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:23.880435Z"}],"ghsa":[{"id":"GHSA-ffmc-4rrr-xm85","title":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows...","description":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.","status":"published","published":"2023-06-06T00:30:19Z","modified":"2025-01-08T18:30:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:59:25.770221Z"}],"nvd":[{"id":"CVE-2023-3027","description":"The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.","status":"published","published":"2023-06-05T22:15:12.293Z","modified":"2026-06-17T06:13:12.32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269","CWE-863"],"updated_at":"2026-11-02T14:08:05.329837Z"}]}}