CVE-2023-29018 json
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation
published 2023-04-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-cwf6-xj49-wp83 , GO-2023-1721 , EUVD-2023-1275
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.
Patch / fix
- go github.com/open-feature/open-feature-operator 0.2.32
- linuxfoundation openfeature 0.2.32
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/open-feature/open-feature-operator | <0.2.32 |
0.2.32 |
Affected products
- open-feature open-feature-operator
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/open-feature/open-feature-operator/security/advisories/GHSA-cwf6-xj49-wp83
web, vendor-advisory, advisory
-
github.com
/open-feature/open-feature-operator/releases/tag/v0.2.32
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-29018
advisory
-
github.com
/open-feature/open-feature-operator
package
Sources
- CVE List CVE-2023-29018
- GitHub Advisory GHSA-cwf6-xj49-wp83
- NVD CVE-2023-29018
- OSV GO-2023-1721
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.