CVE-2023-5528highCWE-20

CVE-2023-5528: high-severity vulnerability in Kubernetes kubelet

Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation

Published · Updated

Follow this CVE+ Monitor kubelet+ Monitor k8s.io/kubernetes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 4.1%
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Kubernetes · kubelet
Related CVEs — Kubernetes kubelet

In the same product, most dangerous first.

CVE-2023-3676HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 13.2%CVE-2023-3955HIGHKubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationEPSS 3.8%CVE-2024-10220HIGHArbitrary command execution through gitRepo volumeEPSS 3.0%CVE-2025-0426MEDIUMCVE-2025-0426EPSS 0.4%