title: Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
description: A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: kubelet
repo: https://github.com/kubernetes/kubernetes
vendor: Kubernetes
versions:
status: affected, version: v1.28.0
lessThanOrEqual: v1.27.4, status: affected, version: v1.27.0, versionType: semver
lessThanOrEqual: v1.26.7, status: affected, version: v1.26.0, versionType: semver
lessThanOrEqual: v1.25.12, status: affected, version: v1.25.0, versionType: semver
status: unaffected, version: v1.28.1
status: unaffected, version: v1.27.5
status: unaffected, version: v1.26.8
status: unaffected, version: v1.25.13
status: unaffected, version: v1.24.17
lessThanOrEqual: v1.24.16, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL