Skip to content
Fencer Vulns
high 7.2

CVE-2023-5408 json

Openshift: modification of node role labels

published 2023-11-02 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-57723

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.11 v4.11.0-202311211130.p0.g7021090.assembly.stream
  • Red Hat Red Hat OpenShift Container Platform 4.12 v4.12.0-202311021630.p0.gfe5e2a1.assembly.stream
  • Red Hat Red Hat OpenShift Container Platform 4.13 v4.13.0-202310210425.p0.gd525f5d.assembly.stream
  • Red Hat Red Hat OpenShift Container Platform 4.14 v4.14.0-202310201027.p0.g8b38d12.assembly.stream
  • kubernetes CBL-Mariner 2.0 1.28.4-5
  • kubernetes Azure Linux 3.0 1.29.1-2

azure linux advisories AZL-31786AZL-34898

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5408 updated cvss 7.2

OpenShift: modification of node role labels

  • Red Hat OpenShift Container Platform 4.11 openshift4/ose-cluster-kube-apiserver-operator v4.11.0-202311211130.p0.g7021090.assembly.stream
    fixed: vendor fix RHSA-2023:7479
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-kube-apiserver-operator v4.12.0-202311021630.p0.gfe5e2a1.assembly.stream
    fixed: vendor fix RHSA-2023:6842
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-kube-apiserver-operator v4.13.0-202310210425.p0.gd525f5d.assembly.stream
    fixed: vendor fix RHSA-2023:6130
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cluster-kube-apiserver-operator v4.14.0-202310201027.p0.g8b38d12.assembly.stream
    fixed: vendor fix RHSA-2023:5006
  • Red Hat OpenShift Container Platform 4.11 rhcos 411.86.202311221858-0, openshift4/ose-cli v4.11.0-202311211130.p0.gbbc7c58.assembly.stream, openshift4/ose-pod v4.11.0-202311211130.p0.g49011e3.assembly.stream, openshift4/ose-etcd v4.11.0-202311211130.p0.g05004fb.assembly.stream, openshift4/ose-tests v4.11.0-202311211130.p0.gb34b8a2.assembly.stream, openshift4/ose-console v4.11.0-202311211130.p0.g71da8a5.assembly.stream, +175 more Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202311051457-0, openshift4/ose-cli v4.12.0-202311021630.p0.ga55beda.assembly.stream, openshift4/ose-pod v4.12.0-202311021630.p0.gbcb9a60.assembly.stream, openshift4/ose-etcd v4.12.0-202311021630.p0.g9f987a5.assembly.stream, openshift4/ose-tests v4.12.0-202311030030.p0.g7b7d4ef.assembly.stream, openshift4/ose-console v4.12.0-202311080948.p0.gac4c1a7.assembly.stream, +181 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202310210500-0, openshift4/ose-cli v4.13.0-202310210425.p0.g717d4a5.assembly.stream, openshift4/ose-pod v4.13.0-202310210425.p0.g636f2be.assembly.stream, openshift4/ose-tests v4.13.0-202310210425.p0.g4b36925.assembly.stream, openshift4/ose-console v4.13.0-202310251444.p0.gb19a691.assembly.stream, openshift4/ose-coredns v4.13.0-202310210425.p0.g598440f.assembly.stream, +185 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, openshift4/ose-console v4.14.0-202310201027.p0.gc16ab01.assembly.stream, openshift4/ose-coredns v4.14.0-202310201027.p0.gfd70cf1.assembly.stream, +180 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12 mo ago

Exploit prediction

1.51% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.11
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.