CVE-2023-5528: fedoraproject fedora Improper Input Validation
CVSS: 8.8v3.1HighAnalyzed
AliasesCGA-328v-5jgc-6v58CGA-3v48-pj66-7hx3CGA-45cf-jjmr-p224CGA-654c-j3cq-x34jCGA-76pp-69rw-v4vqCGA-7fgf-f44x-f537CGA-9wff-m3wj-pw8pCGA-c2pw-xv56-chcmCGA-hc5j-5p8m-v486CGA-jjp6-8v8f-pmfvCGA-j9xc-792w-g9h4CGA-v7c3-v7v4-rccrGHSA-hq6q-c2x6-hmchGO-2023-2341CGA-jmgg-6vwm-9ww8CGA-p26r-qfh9-3p3jCGA-qqmx-3563-rvwjCGA-r228-928x-xvhpCGA-rhv8-j5pg-248cCGA-v982-ch4m-qwfcCGA-w6jq-pfq4-4mm4CGA-3v5v-cw4f-83wxCGA-4wx2-px88-235mCGA-58f9-r2jv-hfqpCGA-857r-78fg-f4m7
Published 14-11-2023Last modified 25-02-2026
Vulnerability summary
CVE-2023-5528 is a high (CVSS 8.8) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 4.25% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
4.25%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 29OPENSUSE-SU-2025:15424-1CGA-35QX-C4PH-XFM9CGA-37X4-PX7C-CRCPCGA-38M5-HQWJ-WPMPCGA-4P6G-GVR7-CRWCCGA-6GC7-39RQ-FJC8CGA-6M3X-5RG4-HR7XCGA-6VGV-43XX-XGR7CGA-7232-W9M3-J7G7CGA-754C-4GP9-66FMCGA-96M6-53H9-8FQ6CGA-9757-28V5-J7RPCGA-9CP6-R389-4724CGA-CQH4-9M87-GVFJCGA-F7GM-J25V-GH6WCGA-HVRC-8HVJ-Q448CGA-J8WX-9MHC-2R24CGA-MF5F-65FR-3GPCCGA-P73X-JF98-4M9MCGA-P79M-XWX3-VM4XCGA-PP28-CM29-Q36GCGA-QHX4-5H2X-87MFCGA-QV9M-2453-W9MPCGA-R225-679C-4F5VCGA-R474-RV27-335HCGA-VX54-68RP-7838CGA-W7RX-872V-5M2HCGA-WF8G-JW65-WR86CGA-XQJ2-JRFV-PX48
Timeline
- 14-11-2023PublishedVulnerability first disclosed.
- 25-02-2026Last modifiedVulnerability information updated.
Description
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.2–8.8
- CVE.orgCNA7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · GoEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
4.25%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.25% on 19-09-2026
19-09-202619-10-2026
EPSS score4.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard16 products
- aws-ebs-csi-driver< 1.25.0-r2
- aws-efs-csi-driver< 1.7.1-r1
- aws-efs-csi-driver-fips< 1.7.0-r5
- cluster-autoscaler-1.26< 1.26.4-r5
- cluster-autoscaler-1.26-compat< 1.26.4-r5
Wolfi14 products
- aws-efs-csi-driver< 1.7.1-r1
- cluster-autoscaler-1.26< 1.26.4-r5
- cluster-autoscaler-1.26-compat< 1.26.4-r5
- cluster-autoscaler-1.27< 1.27.3-r7
- cluster-autoscaler-1.27-compat< 1.27.3-r7
Kubernetes2 products
- kubelet≥ v1.28.0, ≤ v1.28.3 | ≥ v1.27.0, ≤ v1.27.7 | ≥ v1.26.0, ≤ v1.26.10 | ≤ v1.25.15
- kubernetes≥ 1.8.0, < 1.25.16 | ≥ 1.26.0, < 1.26.11 | ≥ 1.27.0, < 1.27.8 | ≥ 1.28.0, < 1.28.4
Fedoraproject1 product
- fedoraEOL37 | 38 | 39
K8s.io1 product
- kubernetes≥ 1.27.0, < 1.27.8 | ≥ 1.26.0, < 1.26.11 | < 1.25.16 | ≥ 1.28.0, < 1.28.4
5 vendors · 34 products
