{"id":"CVE-2023-3893","aliases":["DEBIAN-CVE-2023-3893","EUVD-2023-3024","GHSA-r6cc-7wj7-gfx2","GO-2023-2176","UBUNTU-CVE-2023-3893"],"status":"published","title":"Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02475,"percentile":0.84662,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-11-03T17:34:10Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy/v2","fixed_in":["2.0.0-alpha.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","fixed_in":["1.1.3","0.0.0-20230821192013-2523e6674ded","1.1.3-0.20230821192013-2523e6674ded"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-alpha.0"},{"last_affected":"2.0.0-alpha.0"},{"fixed":"2.0.0-alpha.1"}]}],"versions":["2.0.0-alpha.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0-rc1"},{"last_affected":"1.1.2"},{"fixed":"1.1.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20230821192013-2523e6674ded"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-0"},{"fixed":"1.1.3-0.20230821192013-2523e6674ded"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha.0"},{"fixed":"2.0.0-alpha.1"}]}],"versions":["2.0.0-alpha.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0-rc1"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20230821192013-2523e6674ded"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.3-0"},{"fixed":"1.1.3-0.20230821192013-2523e6674ded"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kubernetes-csi/csi-proxy/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0-alpha.0"},{"fixed":"2.0.0-alpha.1"}]}]}],"products":[{"vendor":"kubernetes","product":"csi-proxy"},{"vendor":"kubernetes","product":"csi_proxy"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/119594","tags":["issue-tracking","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ","tags":["mailing-list","x_transferred","Mailing List","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231221-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3893","tags":["advisory"]},{"url":"https://github.com/kubernetes-csi/csi-proxy/commit/0e83a68159111e4ee510f5aa56d47ba97bda60c7","tags":["web","fix"]},{"url":"https://github.com/kubernetes-csi/csi-proxy/commit/2523e6674dedf3de27f84235efec28555da24664","tags":["web","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20231221-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r6cc-7wj7-gfx2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3893.json","tags":["advisory"]},{"url":"https://github.com/kubernetes-csi/csi-proxy","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-3893","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-3893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3893","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-3893","title":"Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.","status":"published","published":"2023-11-03T17:34:10.188Z","modified":"2025-02-13T17:02:36.473Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:24.360381Z"}],"euvd":[{"id":"EUVD-2023-3024","description":"A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.","status":"published","published":"2023-11-03T17:34:10Z","modified":"2025-02-13T17:02:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:49.604577Z"}],"ghsa":[{"id":"GHSA-r6cc-7wj7-gfx2","title":"Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation","description":"Kubernetes is vulnerable to privilege escalation when a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.","status":"published","published":"2023-11-03T18:30:24Z","modified":"2025-07-09T15:32:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2023-3893","description":"A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.","status":"published","published":"2023-11-03T18:15:08.623Z","modified":"2026-06-17T06:15:15.613Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-3893","title":"Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user that can \ncreate pods on Windows nodes running kubernetes-csi-proxy may be able to\n escalate to admin privileges on those nodes. Kubernetes clusters are \nonly affected if they include Windows nodes running \nkubernetes-csi-proxy.","status":"published","published":"2023-11-03T17:34:10.188Z","modified":"2026-10-28T02:31:14.983891395Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DEBIAN-CVE-2023-3893","description":"A security issue was discovered in Kubernetes where a user that can  create pods on Windows nodes running kubernetes-csi-proxy may be able to  escalate to admin privileges on those nodes. Kubernetes clusters are  only affected if they include Windows nodes running  kubernetes-csi-proxy.","status":"published","published":"2023-11-03T18:15:08.623Z","modified":"2026-10-26T18:01:59.404769351Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-r6cc-7wj7-gfx2","title":"Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation","description":"Kubernetes is vulnerable to privilege escalation when a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.","status":"published","published":"2023-11-03T18:30:24Z","modified":"2025-07-09T15:32:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2023-3893","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to  escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.","status":"withdrawn","published":"2023-11-03T18:15:00Z","modified":"2025-08-05T04:53:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"GO-2023-2176","title":"Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy","description":"Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy","status":"published","published":"2024-08-21T14:30:22Z","modified":"2026-03-03T04:54:20.134606Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}