{"id":"CVE-2023-3955","aliases":["DEBIAN-CVE-2023-3955","EUVD-2023-2793","GHSA-q78c-gwqw-jcmc","GO-2023-2170","openSUSE-SU-2024:14599-1"],"status":"published","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03776,"percentile":0.9002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2023-10-31T20:36:54Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.28.1","1.27.5","1.26.8","1.25.13","1.24.17"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.5+really1.20.2-1"],"sources":["osv"]},{"ecosystem":"Go","package":"k8s.io/mount-utils","fixed_in":["0.24.17","0.25.13","0.26.8","0.27.5","0.28.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0"},{"last_affected":"1.28.0"},{"fixed":"1.28.1"}]}],"versions":["1.28.0"]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"fixed":"1.27.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.0"},{"fixed":"1.25.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.17"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.5+really1.20.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.28.0"},{"fixed":"1.28.1"}]}],"versions":["1.28.0"]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.27.0"},{"fixed":"1.27.5"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.26.8"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"1.25.0"},{"fixed":"1.25.13"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.17"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.24.17"},{"introduced":"1.25.0"},{"fixed":"1.25.13"},{"introduced":"1.26.0"},{"fixed":"1.26.8"},{"introduced":"1.27.0"},{"fixed":"1.27.5"},{"introduced":"1.28.0"},{"fixed":"1.28.1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/mount-utils","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.24.17"},{"introduced":"0.25.0"},{"fixed":"0.25.13"},{"introduced":"0.26.0"},{"fixed":"0.26.8"},{"introduced":"0.27.0"},{"fixed":"0.27.5"},{"introduced":"0.28.0"},{"fixed":"0.28.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241213T205935-1.1"}]}],"bundled":21}],"products":[{"vendor":"kubernetes","product":"kubelet"},{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://github.com/kubernetes/kubernetes/issues/119595","tags":["issue-tracking","x_transferred","Exploit","Mitigation","Patch","Third Party Advisory","report","web"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E","tags":["mailing-list","x_transferred","Technical Description","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231221-0002/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3955","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120128","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120134","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120135","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120136","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120137","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/pull/120138","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/38c97fa67ed35f36e730856728c9e3807f63546a","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/50334505cd27cbe7cf71865388f25a00e29b2596","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/b7547e28f898af37aa2f1107a49111f963250fe6","tags":["web"]},{"url":"https://github.com/kubernetes/kubernetes/commit/c4e17abb04728e3a3f9bb26e727b0f978df20ec9","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231221-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q78c-gwqw-jcmc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3955.json","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-3955","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QTUY324RV3FFZBHVIWDHRCIOPJHIJIN4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-3955","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:36:54.352Z","modified":"2025-02-13T17:03:13.47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-2793","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:36:54Z","modified":"2025-02-13T17:03:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:49.604577Z"}],"ghsa":[{"id":"GHSA-q78c-gwqw-jcmc","title":"Kubernetes privilege escalation vulnerability","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2023-10-31T21:32:35Z","modified":"2025-02-13T19:20:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-3955","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T21:15:08.613Z","modified":"2026-06-17T06:15:27.783Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:08:41.047232Z"}],"osv":[{"id":"CVE-2023-3955","title":"Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation","description":"A security issue was discovered in Kubernetes where a user\n that can create pods on Windows nodes may be able to escalate to admin \nprivileges on those nodes. Kubernetes clusters are only affected if they\n include Windows nodes.","status":"published","published":"2023-10-31T20:36:54.352Z","modified":"2026-10-28T02:30:28.94164606Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-3955","description":"A security issue was discovered in Kubernetes where a user  that can create pods on Windows nodes may be able to escalate to admin  privileges on those nodes. Kubernetes clusters are only affected if they  include Windows nodes.","status":"published","published":"2023-10-31T21:15:08.613Z","modified":"2026-10-26T18:02:31.30963916Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-q78c-gwqw-jcmc","title":"Kubernetes privilege escalation vulnerability","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2023-10-31T21:32:35Z","modified":"2026-09-10T03:50:04.037447368Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GO-2023-2170","title":"Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils","description":"A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.","status":"published","published":"2024-08-21T14:30:22Z","modified":"2026-02-04T03:13:15.115479Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T02:20:26.243259Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}