CVE-2023-3676
published 2023-10-31CVE-2023-3676: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
11.67%
95.5th percentile
A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | kubernetes | < kubernetes 1.20.5+really1.20.2-1 (bookworm) | kubernetes 1.20.5+really1.20.2-1 (bookworm) |
| k8s.io | kubernetes | >= 0 < 1.24.17 | 1.24.17 |
| k8s.io | kubernetes | >= 1.25.0 < 1.25.13 | 1.25.13 |
| k8s.io | kubernetes | >= 1.26.0 < 1.26.8 | 1.26.8 |
| k8s.io | kubernetes | >= 1.27.0 < 1.27.5 | 1.27.5 |
| k8s.io | kubernetes | >= 1.28.0 < 1.28.1 | 1.28.1 |
| kubernetes | kubelet | <= v1.24.16 | — |
| kubernetes | kubelet | — | — |
| kubernetes | kubelet | v1.25.0 – v1.25.12 | — |
| kubernetes | kubelet | v1.26.0 – v1.26.7 | — |
| kubernetes | kubelet | v1.27.0 – v1.27.4 | — |
| kubernetes | kubernetes | < 1.24.17 | 1.24.17 |
| kubernetes | kubernetes | >= 0 < 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
| kubernetes | kubernetes | >= 0 < 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
| kubernetes | kubernetes | >= 0 < 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
| kubernetes | kubernetes | >= 0 < 1.20.5+really1.20.2-1 | 1.20.5+really1.20.2-1 |
| kubernetes | kubernetes | >= 1.25.0 < 1.25.13 | 1.25.13 |
| kubernetes | kubernetes | >= 1.26.0 < 1.26.8 | 1.26.8 |
| kubernetes | kubernetes | >= 1.27.0 < 1.27.5 | 1.27.5 |
| kubernetes | kubernetes | >= 1.28.0 < 1.28.1 | 1.28.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Run the following command to detect if any Windows nodes are present in the cluster, which indicates exposure to this vulnerability. ↗
- ·Only Kubernetes clusters that include Windows nodes are affected by this privilege escalation vulnerability. Pure Linux clusters are not impacted. ↗
- ·The root cause is insufficient input sanitization on Windows nodes, allowing a pod-creating user to escalate to admin privileges on those nodes. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kubernetes: Insufficient input sanitization on Windows nodes leads to privilege escalation
vendor_redhat·2023-08-23·CVSS 8.8
CVE-2023-3676 [HIGH] CWE-269 kubernetes: Insufficient input sanitization on Windows nodes leads to privilege escalation
kubernetes: Insufficient input sanitization on Windows nodes leads to privilege escalation
A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
A vulnerability was found in Kubernetes. This flaw allows a user who can create pods on Windows nodes to escalate to admin privileges on those nodes.
Statement: Kubernetes clusters are only affected if they include Windows nodes. Any Kubernetes environment with Windows nodes is impacted. Run kubectl get nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.
Debian
CVE-2023-3676: kubernetes - A security issue was discovered in Kubernetes where a user that can create pods...
vendor_debian·2023·CVSS 8.8
CVE-2023-3676 [HIGH] CVE-2023-3676: kubernetes - A security issue was discovered in Kubernetes where a user that can create pods...
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Scope: local
bookworm: resolved (fixed in 1.20.5+really1.20.2-1)
bullseye: resolved (fixed in 1.20.5+really1.20.2-1)
forky: resolved (fixed in 1.20.5+really1.20.2-1)
sid: resolved (fixed in 1.20.5+really1.20.2-1)
trixie: resolved (fixed in 1.20.5+really1.20.2-1)
OSV
Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
osv·2024-08-21
CVE-2023-3676 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
OSV
Kubernetes privilege escalation vulnerability
osv·2023-10-31
CVE-2023-3676 [HIGH] Kubernetes privilege escalation vulnerability
Kubernetes privilege escalation vulnerability
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
OSV
CVE-2023-3676: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those
osv·2023-10-31·CVSS 8.8
CVE-2023-3676 [HIGH] CVE-2023-3676: A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
GHSA
Kubernetes privilege escalation vulnerability
ghsa·2023-10-31
CVE-2023-3676 [HIGH] CWE-20 Kubernetes privilege escalation vulnerability
Kubernetes privilege escalation vulnerability
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
No detection rules found.
No public exploits indexed.
Wiz
EKS Security Best Practices | Wiz
blogs_wiz·2026-02-25
EKS Security Best Practices | Wiz
## What is Amazon EKS?
Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service from AWS that operates the control plane—including the Kubernetes API server and etcd—within an AWS-managed virtual private cloud (VPC). AWS automatically scales, patches, and updates these components, allowing customers to interact with the control plane via Kubernetes and AWS APIs without the overhead of provisioning or managing the infrastructure themselves.
The shared responsibility model shapes the security posture of EKS:
AWS secures the underlying infrastructure and control plane.
Customers secure the upper layers by hardening nodes, protecting workloads, and configuring network, identity, and policy controls.
While AWS delivers automation and resiliency, teams manage configuration, c
Wiz
EKS Security Best Practices | Wiz
blogs_wiz·2026-02-25
EKS Security Best Practices | Wiz
## What is Amazon EKS?
Amazon Elastic Kubernetes Service (EKS) is a managed Kubernetes service from AWS that operates the control plane—including the Kubernetes API server and etcd—within an AWS-managed virtual private cloud (VPC). AWS automatically scales, patches, and updates these components, allowing customers to interact with the control plane via Kubernetes and AWS APIs without the overhead of provisioning or managing the infrastructure themselves.
The shared responsibility model shapes the security posture of EKS:
- AWS secures the underlying infrastructure and control plane.
- Customers secure the upper layers by hardening nodes, protecting workloads, and configuring network, identity, and policy controls.
While AWS delivers automation and resiliency, teams manage configuration
Wiz
Crying Out Cloud - August Newsletter | Wiz
blogs_wiz·2023-08-30·CVSS 6.5
[MEDIUM] Crying Out Cloud - August Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's delve in.
Editor’s note: some of you may have noticed that we accidentally resent last month’s edition (July) – this was due to a technical issue for which we apologize.
Moving on – here are our top picks of cloud security highlights!
## 🐞 High Profile Vulnerabilities
## High severity vulnerabilities in Kubernetes on Windows nodes
Three high severity Kubernetes vulnerabilities were published on August 23. All three are flaws related to insufficient sanitization that could lead to privilege escalation. Kubernetes clusters are only affected by these vulnerabilities if they include Windows nodes. The vulnerabilities were assigned CVE-2023-3676
https://github.com/kubernetes/kubernetes/issues/119339https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zchttps://security.netapp.com/advisory/ntap-20231130-0007/https://github.com/kubernetes/kubernetes/issues/119339https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zchttps://security.netapp.com/advisory/ntap-20231130-0007/
2023-10-31
Published