High severityNVD Advisory· Published Nov 3, 2023· Updated Feb 13, 2025
Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation
CVE-2023-3893
Description
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/kubernetes-csi/csi-proxy/v2Go | >= 2.0.0-alpha.0, < 2.0.0-alpha.1 | 2.0.0-alpha.1 |
github.com/kubernetes-csi/csi-proxyGo | >= 0.1.0-rc1, < 1.1.3 | 1.1.3 |
github.com/kubernetes-csi/csi-proxyGo | < 0.0.0-20230821192013-2523e6674ded | 0.0.0-20230821192013-2523e6674ded |
github.com/kubernetes-csi/csi-proxyGo | >= 1.1.3-0, < 1.1.3-0.20230821192013-2523e6674ded | 1.1.3-0.20230821192013-2523e6674ded |
Affected products
3- ghsa-coords2 versions
>= 0.1.0-rc1, < 1.1.3+ 1 more
- (no CPE)range: >= 0.1.0-rc1, < 1.1.3
- (no CPE)range: >= 2.0.0-alpha.0, < 2.0.0-alpha.1
- Kubernetes/csi-proxyv5Range: v2.0.0-alpha.0
Patches
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- github.com/advisories/GHSA-r6cc-7wj7-gfx2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-3893ghsaADVISORY
- github.com/kubernetes-csi/csi-proxy/commit/0e83a68159111e4ee510f5aa56d47ba97bda60c7ghsaWEB
- github.com/kubernetes-csi/csi-proxy/commit/2523e6674dedf3de27f84235efec28555da24664ghsaWEB
- github.com/kubernetes/kubernetes/issues/119594ghsaissue-trackingWEB
- groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQghsamailing-listWEB
- security.netapp.com/advisory/ntap-20231221-0004ghsaWEB
- security.netapp.com/advisory/ntap-20231221-0004/mitre
News mentions
0No linked articles in our index yet.