CVE-2023-2728
Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
- Published
- Updated
- Reserved
- Assigned by
- kubernetes
Description
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
Timeline
ID reserved
By kubernetes
- 48 days later
· 48 days later
Published
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| kubernetesCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 2.2% · top 18% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
- affected v1.24.14 – ≤ <=
- affected v1.25.0 - v1.25.10
- affected v1.26.0 - v1.26.5
- affected v1.27.0 - v1.27.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gok8s.io/kubernetesGHSA-cgcv-5272-97pr (opens in a new tab)
What to do
Solution: To mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster
References (4)
- https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 (opens in a new tab)mailing-listx_transferred
- https://github.com/kubernetes/kubernetes/issues/118640 (opens in a new tab)issue-trackingx_transferred
- http://www.openwall.com/lists/oss-security/2023/07/06/3 (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20230803-0004/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-cgcv-5272-97pr (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-2728)Record last updated .