CVE-2023-2728

🗓️ 03 Jul 2023 20:06:11Reported by kubernetesType

cve🔗 web.nvd.nist.gov👁 2792 Views🌐 WEB

Users may bypass mountable secrets policy in Kubernetes clusters with ServiceAccount admission plugin and `kubernetes.io/enforce-mountable-secrets` annotation when using ephemeral containers

Reporter	Title	Published	Views	Family All 111
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.	30 Jan 202617:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2023-2728)	13 Jul 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	12 Nov 202519:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	7 Nov 202516:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable due to k8s.io/kubernetes ( CVE-2023-2728, CVE-2023-2727, CVE-2023-5408, CVE-2023-3955, CVE-2023-3676 )	8 Aug 202415:28	–	ibm
AlpineLinux	CVE-2023-2728	3 Jul 202320:06	–	alpinelinux
Chainguard	CVE-2023-2728 vulnerabilities	3 Jul 202321:15	–	cgr
Circl	CVE-2023-2728	4 Jul 202300:23	–	circl
CNNVD	Kubernetes 安全漏洞	15 Jun 202300:00	–	cnnvd

NVD

Node

kubernetes kubernetesRange≤1.24.14

kubernetes kubernetesRange1.25.0–1.25.10

kubernetes kubernetesRange1.26.0–1.26.5

kubernetes kubernetesRange1.27.0–1.27.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThanOrEqual": "<=",
        "status": "affected",
        "version": "v1.24.14",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "v1.25.0 - v1.25.10"
      },
      {
        "status": "affected",
        "version": "v1.26.0 - v1.26.5"
      },
      {
        "status": "affected",
        "version": "v1.27.0 - v1.27.2"
      }
    ]
  }
]

Source	Link
groups	www.groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8
github	www.github.com/kubernetes/kubernetes/issues/118640
openwall	www.openwall.com/lists/oss-security/2023/07/06/3
security	www.security.netapp.com/advisory/ntap-20230803-0004/

Parameter	Position	Path	Description	CWE
metadata.name	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation with envFrom secretRef to expose secrets in container environment variables (mountable secrets bypass).	CWE-20
metadata.namespace	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation with envFrom secretRef to expose secrets in container environment variables (mountable secrets bypass).	CWE-20
spec.containers[].envFrom.secretRef.name	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation with envFrom secretRef to expose secrets in container environment variables (mountable secrets bypass).	CWE-20
spec.containers[].envFrom.secretRef	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation with envFrom secretRef to expose secrets in container environment variables (mountable secrets bypass).	CWE-20
spec.initContainers[].envFrom.secretRef.name	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20
spec.initContainers[].image	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20
spec.initContainers[].command	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20
spec.initContainers[].args	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20
metadata.namespace	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20
metadata.name	request body	/api/v1/namespaces/dvwa-tfm-mysql/pods	Pod creation including an initContainer that references a secret, enabling secret exposure during initialization.	CWE-20

17 Jun 2026 05:53Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

EPSS0.02157

SSVC

CWE-20