CVE-2023-3893

highpriority · track · 36EPSS 0.025 · 84 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.48% (84th) EPSS

CVSS 8.8 · high

Is it mine?

16 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · jordan@liggitt.netexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-269US

affected products (16)

Products and version ranges known to be affected.

Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat OpenShiftall versionscert_bundDEcpe:/a:redhat:openshift:-
Red Hat OpenShift Container Platform 4.11all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.11
Red Hat OpenShift Container Platform 4.12all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.12
Kubernetes csi-proxy≤ v2.0.0-alpha.0enisa_euvdEU
Kubernetes csi-proxy≤ 0 ≤v1.1.2enisa_euvdEU
The Kubernetes Authors kubernetes-csi-proxy≤ 2.0.0-alpha.1fstec_bduRU
The Kubernetes Authors kubernetes-csi-proxy≤ 1.1.3fstec_bduRU
kubernetes csi proxy≤ 1.1.2nvdUScpe:2.3:a:kubernetes:csi_proxy:*:*:*:*:*:*:*:*
kubernetes csi proxy= 2.0.0nvdUScpe:2.3:a:kubernetes:csi_proxy:*:*:*:*:*:*:*:*
Go github.com/kubernetes-csi/csi-proxy< 0.0.0-20230821192013-2523e6674dedosvUSpkg:golang/github.com/kubernetes-csi/csi-proxy
Go github.com/kubernetes-csi/csi-proxy< 1.1.3osvUSpkg:golang/github.com/kubernetes-csi/csi-proxy
Go github.com/kubernetes-csi/csi-proxy0.1.0-rc1 → 1.1.3osvUSpkg:golang/github.com/kubernetes-csi/csi-proxy
Go github.com/kubernetes-csi/csi-proxy1.1.3-0 → 1.1.3-0.20230821192013-2523e6674dedosvUSpkg:golang/github.com/kubernetes-csi/csi-proxy
Go github.com/kubernetes-csi/csi-proxy/v22.0.0-alpha.0 → 2.0.0-alpha.1osvUSpkg:golang/github.com/kubernetes-csi/csi-proxy/v2

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2163Kubernetes: Mehrere SchwachstellenDeutsch2023-08-23csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Kubernetes ausnutzen, um seine Privilegien zu erhöhen.
GHSA-r6cc-7wj7-gfx2Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation2023-11-03ghsa · osvUS
Kubernetes is vulnerable to privilege escalation when a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.
GO-2023-2176Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy2024-08-21vendor · osvUS
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation in github.com/kubernetes-csi/csi-proxy

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2023-11-03modified 2026-06-17

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan