title: Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
description: A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: kubelet
repo: https://github.com/kubernetes/kubernetes
vendor: Kubernetes
versions:
lessThanOrEqual: v1.28.3, status: affected, version: v1.28.0, versionType: semver
lessThanOrEqual: v1.27.7, status: affected, version: v1.27.0, versionType: semver
lessThanOrEqual: v1.26.10, status: affected, version: v1.26.0, versionType: semver
lessThanOrEqual: v1.25.15, status: affected, version: 0, versionType: semver
status: unaffected, version: v1.28.4
status: unaffected, version: v1.27.8
status: unaffected, version: v1.26.11
status: unaffected, version: v1.25.16
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL