CVE-2023-3027
highpriority · track · 31OT risk · elevatedEPSS 0.002 · 10 %ileEUUSEPSS · scored 2026-10-27
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
- redhat advanced cluster management for kubernetes= 2.5nvdUScpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
- redhat advanced cluster management for kubernetes= 2.6nvdUScpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
- redhat advanced cluster management for kubernetes= 2.7nvdUScpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2023-3027cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-3027/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.4982cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0enisa_euvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0Issue TrackingVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan