{"cve":"CVE-2023-5528","nvd":{"published":"2023-11-14T21:15:14.123","modified":"2026-06-17T06:48:46.373","status":"Analyzed","description":"A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-20"],"references":["https://github.com/kubernetes/kubernetes/issues/121879","https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA","https://github.com/kubernetes/kubernetes/issues/121879","https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/"],"products":["fedoraproject:fedora","kubernetes:kubernetes"],"source":"nvd","synced_at":"2026-10-19T21:42:07.670898610+00:00"},"epss":{"cve":"CVE-2023-5528","score":0.04095,"percentile":0.90741,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-hq6q-c2x6-hmch","url":"https://osv.dev/vulnerability/GHSA-hq6q-c2x6-hmch","summary":"Kubernetes Improper Input Validation vulnerability","modified":"2026-09-10T03:49:59.095022055Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.28.0 <1.28.4"],"fixed":["1.28.4"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.27.0 <1.27.8"],"fixed":["1.27.8"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.26.0 <1.26.11"],"fixed":["1.26.11"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":["<1.25.16"],"fixed":["1.25.16"]}]},{"id":"GO-2023-2341","url":"https://osv.dev/vulnerability/GO-2023-2341","summary":"Kubernetes Improper Input Validation vulnerability in k8s.io/kubernetes","modified":"2026-02-04T02:29:52.335102Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":["<1.25.16",">=1.26.0 <1.26.11",">=1.27.0 <1.27.8",">=1.28.0 <1.28.4"],"fixed":["1.25.16","1.26.11","1.27.8","1.28.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}