VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 3, 2023· Updated Feb 13, 2025

Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin

CVE-2023-2728

Description

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/kubernetesGo
>= 1.27.0, < 1.27.31.27.3
k8s.io/kubernetesGo
>= 1.26.0, < 1.26.61.26.6
k8s.io/kubernetesGo
>= 1.25.0, < 1.25.111.25.11
k8s.io/kubernetesGo
< 1.24.151.24.15

Affected products

73

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.