Skip to content
Fencer Vulns
high 8.0

CVE-2023-1260 json

Kube-apiserver: privesc

published 2023-09-24 3 y ago modified 2026-06-17 4 mo ago also GHSA-92hx-3mh6-hc49 , EUVD-2023-2468

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.

Patch / fix

  • go github.com/openshift/apiserver-library-go 0.0.0-20230621
  • Red Hat Red Hat OpenShift Container Platform 4.10 0:4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7
  • Red Hat Red Hat OpenShift Container Platform 4.11 0:4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.12 0:4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.13 0:4.13.0-202307132344.p0.gf245ced.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 0:4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9
  • openshift openshift 4.13 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8
  • openshift openshift 4.13 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9
  • openshift-clients openshift 4.13 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8
  • openshift-clients openshift 4.13 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9
  • openshift-hyperkube openshift 4.13 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8
  • openshift-hyperkube openshift 4.13 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9
  • openshift-clients-redistributable openshift 4.13 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8
  • openshift-clients-redistributable openshift 4.13 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9

red hat advisories RHSA-2023:4093RHSA-2023:5008RHSA-2023:4898RHSA-2023:4312RHSA-2023:3976

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-1260 updated cvss 8.0

kube-apiserver: PrivEsc

  • Red Hat OpenShift Container Platform 4.10 openshift 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7, openshift 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8, openshift-hyperkube 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7, openshift-hyperkube 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8
    fixed: vendor fix RHSA-2023:4898
  • Red Hat OpenShift Container Platform 4.11 openshift 4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8, openshift-hyperkube 4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8
    fixed: vendor fix RHSA-2023:4312
  • Red Hat OpenShift Container Platform 4.12 openshift 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8, openshift 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9, openshift-hyperkube 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8, openshift-hyperkube 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9
    fixed: vendor fix RHSA-2023:3976
  • Red Hat OpenShift Container Platform 4.13 openshift 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9, openshift-hyperkube 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, openshift-hyperkube 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9
    fixed: vendor fix RHSA-2023:4093
  • Red Hat OpenShift Container Platform 4.14 microshift 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-selinux 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-networking 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9, microshift-release-info 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9
    fixed: vendor fix RHSA-2023:5008
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.13 openstack-ironic 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-api 21.3.1-0.20230706125653.c8f8157.el9, python3-ironic-tests 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-common 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-conductor 21.3.1-0.20230706125653.c8f8157.el9, openstack-ironic-dnsmasq-tftp-server 21.3.1-0.20230706125653.c8f8157.el9 Red Hat OpenShift Container Platform 4 openshift4/ose-pod, openshift4/ose-tests, openshift4/ose-openshift-apiserver-rhel9 Red Hat OpenShift Container Platform 4.10 perf 4.18.0-305.103.1.el8_4, kernel 4.18.0-305.103.1.el8_4, bpftool 4.18.0-305.103.1.el8_4, kernel-core 4.18.0-305.103.1.el8_4, kernel-tools 4.18.0-305.103.1.el8_4, python3-perf 4.18.0-305.103.1.el8_4, +32 more Red Hat OpenShift Container Platform 4.11 cri-o 1.24.6-4.rhaos4.11.git4bfe15a.el8, openshift-clients 4.11.0-202307200522.p0.g7e1b2fb.assembly.stream.el8, openshift-clients-redistributable 4.11.0-202307200522.p0.g7e1b2fb.assembly.stream.el8 Red Hat OpenShift Container Platform 4.13 ovn23.06 23.06.0-13.el9fdp, perf 5.14.0-284.23.1.el9_2, rtla 5.14.0-284.23.1.el9_2, bpftool 7.0.0-284.23.1.el9_2, kernel 5.14.0-284.23.1.el9_2, nmstate 2.2.12-1.rhaos4.13.el8, +94 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/openshift/apiserver-library-go
<0.0.0-20230621
0.0.0-20230621

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.10
  • Red Hat Red Hat OpenShift Container Platform 4.11
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.