{"id":"CVE-2023-3676","aliases":["DEBIAN-CVE-2023-3676","EUVD-2023-2686","GHSA-7fxm-f474-hf8w","GO-2023-2330","UBUNTU-CVE-2023-3676","openSUSE-SU-2024:14599-1"],"status":"published","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.13156,"percentile":0.9639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-10-31T20:22:53Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.28.1","1.27.5","1.26.8","1.25.13","1.24.17"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0"},{"last_affected":"1.28.0"},{"fixed":"1.28.1"}]}],"versions":["1.28.0"]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"fixed":"1.27.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0"},{"fixed":"1.25.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.28.0"},{"fixed":"1.28.1"}]}],"versions":["1.28.0"]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.27.0"},{"fixed":"1.27.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.26.8"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.25.0"},{"fixed":"1.25.13"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.17"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.17"},{"introduced":"1.25.0"},{"fixed":"1.25.13"},{"introduced":"1.26.0"},{"fixed":"1.26.8"},{"introduced":"1.27.0"},{"fixed":"1.27.5"},{"introduced":"1.28.0"},{"fixed":"1.28.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241213T205935-1.1"}]}],"bundled":21}],"products":[{"vendor":"kubernetes","product":"kubelet"},{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/119339","tags":["issue-tracking","x_transferred","Exploit","Mitigation","Patch","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc","tags":["mailing-list","x_transferred","Third Party Advisory","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0007/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3676","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120127","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120129","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120130","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120131","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120132","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120133","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/073f9ea33a93ddaecdc2e829150fb715f6387399","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/39cc101c7855341c651a943b9836b50fbace8a6b","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/74b617310c24ca84c2ec90c3858af745d65b5226","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/890483394221c8f22e88c48f86cd4eaf4de65fd6","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fxm-f474-hf8w","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3676.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-3676","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-3676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3676","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QTUY324RV3FFZBHVIWDHRCIOPJHIJIN4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-3676","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:22:53.62Z","modified":"2025-02-27T20:38:37.768Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-2686","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:22:53Z","modified":"2025-02-27T20:38:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:21.469581Z"}],"ghsa":[{"id":"GHSA-7fxm-f474-hf8w","title":"Kubernetes privilege escalation vulnerability","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2023-10-31T21:32:35Z","modified":"2025-02-13T19:20:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-3676","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T21:15:08.55Z","modified":"2026-06-17T06:14:36.56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-3676","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:22:53.62Z","modified":"2026-10-28T02:30:32.55467247Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"DEBIAN-CVE-2023-3676","description":"A security issue was discovered in Kubernetes where a user  that can create pods on Windows nodes may be able to escalate to admin  privileges on those nodes. Kubernetes clusters are only affected if they  include Windows nodes.","status":"published","published":"2023-10-31T21:15:08.55Z","modified":"2026-10-26T18:02:19.912658205Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-7fxm-f474-hf8w","title":"Kubernetes privilege escalation vulnerability","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2023-10-31T21:32:35Z","modified":"2026-09-10T03:49:58.570245967Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2023-3676","description":"A security issue was discovered in Kubernetes where a user  that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they  include Windows nodes.","status":"withdrawn","published":"2023-10-31T21:15:00Z","modified":"2025-08-05T04:53:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"GO-2023-2330","title":"Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2024-08-21T14:30:22Z","modified":"2026-02-04T04:10:32.011376Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T02:20:26.243259Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}