VYPR
← All advisories
High severityNVD Advisory· Published Nov 14, 2023· Updated Feb 25, 2026

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

CVE-2023-5528

Description

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Kubernetes in-tree storage plugin on Windows nodes lacks input sanitization, allowing users with pod and PV creation privileges to escalate to admin.

Vulnerability

Overview

CVE-2023-5528 is a privilege escalation vulnerability in Kubernetes affecting Windows nodes. The root cause is insufficient input sanitization in the in-tree storage plugin used by the kubelet on Windows. When creating pods and persistent volumes (PVs), a user can inject malicious input that leads to arbitrary command execution with elevated privileges [4].

Exploitation

Prerequisites

An attacker must have the ability to create pods and persistent volumes on a Kubernetes cluster that includes Windows nodes. The vulnerability is only exploitable on clusters using the in-tree storage plugin for Windows, not on those using out-of-tree CSI drivers [1][4]. The attack does not require network access to the node itself, as the malicious PV creation occurs through the Kubernetes API.

Impact and

Severity

Successful exploitation allows an attacker to escalate from a standard user to administrator (SYSTEM) privileges on the Windows node. This can lead to full compromise of the node, including access to all workloads, secrets, and the ability to pivot to other cluster components. The CVSS 3.1 base score is 7.2 (HIGH), reflecting the need for high privileges to initiate the attack [4].

Mitigation

The vulnerability affects kubelet versions from v1.8.0 through v1.25.16, v1.26.11, v1.27.8, and v1.28.4. Patches were released on November 14, 2023, fixing the issue by replacing the unsafe mklink call with a Go library function [2][4]. Administrators should upgrade kubelet on Windows nodes to the fixed versions. No workarounds are available; clusters without Windows nodes are not impacted.

References
  1. NVD - CVE-2023-5528
  2. Use golang library instead of mklink by cji · Pull Request #121881 · kubernetes/kubernetes
  3. CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodes

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/kubernetesGo
>= 1.28.0, < 1.28.41.28.4
k8s.io/kubernetesGo
>= 1.27.0, < 1.27.81.27.8
k8s.io/kubernetesGo
>= 1.26.0, < 1.26.111.26.11
k8s.io/kubernetesGo
< 1.25.161.25.16

Affected products

144

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.