High severity8.0GHSA Advisory· Published Sep 24, 2023· Updated Jun 17, 2026
CVE-2023-1260
CVE-2023-1260
Description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openshift/apiserver-library-goGo | < 0.0.0-20230621 | 0.0.0-20230621 |
Affected products
7- Range: < 0.0.0-20230621
- cpe:2.3:a:kubernetes:kube-apiserver:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
12- access.redhat.com/errata/RHSA-2023:3976nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2023:4093nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2023:4312nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2023:4898nvdThird Party AdvisoryWEB
- access.redhat.com/security/cve/CVE-2023-1260nvdThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-92hx-3mh6-hc49nvdADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-1260ghsaADVISORY
- security.netapp.com/advisory/ntap-20231020-0010/nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2023:5008nvdWEB
- github.com/openshift/apiserver-library-go/commit/a994128188486d2dce99a528fbcc017d276081e0ghsaWEB
- security.netapp.com/advisory/ntap-20231020-0010ghsaWEB
News mentions
0No linked articles in our index yet.