CVE-2023-2728

🗓️ 03 Jul 2023 20:06:11Reported by kubernetesType

cve🔗 web.nvd.nist.gov👁 2770 Views🌐 WEB

Users may bypass mountable secrets policy in Kubernetes clusters with ServiceAccount admission plugin and `kubernetes.io/enforce-mountable-secrets` annotation when using ephemeral containers

Reporter	Title	Published	Views	Family All 101
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.	30 Jan 202617:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2023-2728)	13 Jul 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	12 Nov 202519:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	7 Nov 202516:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable due to k8s.io/kubernetes ( CVE-2023-2728, CVE-2023-2727, CVE-2023-5408, CVE-2023-3955, CVE-2023-3676 )	8 Aug 202415:28	–	ibm
AlpineLinux	CVE-2023-2728	3 Jul 202320:06	–	alpinelinux
Chainguard	CVE-2023-2728 vulnerabilities	3 Jul 202321:15	–	cgr
Circl	CVE-2023-2728	4 Jul 202300:23	–	circl
CNNVD	Kubernetes 安全漏洞	15 Jun 202300:00	–	cnnvd

NVD

Node

kubernetes kubernetesRange≤1.24.14

kubernetes kubernetesRange1.25.0–1.25.10

kubernetes kubernetesRange1.26.0–1.26.5

kubernetes kubernetesRange1.27.0–1.27.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Kubernetes",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThanOrEqual": "<=",
        "status": "affected",
        "version": "v1.24.14",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "v1.25.0 - v1.25.10"
      },
      {
        "status": "affected",
        "version": "v1.26.0 - v1.26.5"
      },
      {
        "status": "affected",
        "version": "v1.27.0 - v1.27.2"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/07/06/3
github	www.github.com/kubernetes/kubernetes/issues/118640
security	www.security.netapp.com/advisory/ntap-20230803-0004/
groups	www.groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8

Parameter	Position	Path	Description	CWE
spec.containers[].envFrom.secretRef.name	request body	/api/v1/namespaces/{namespace}/pods	Pod creation/manipulation to mount secrets via containers, bypassing mountable secrets policy.	CWE-20
spec.initContainers[].envFrom.secretRef.name	request body	/api/v1/namespaces/{namespace}/pods	Pod creation/manipulation to mount secrets via containers, bypassing mountable secrets policy.	CWE-20
spec.ephemeralContainers[].env[].valueFrom.secretKeyRef.name	request body	/api/v1/namespaces/{namespace}/pods	Pod creation/manipulation to mount secrets via containers, bypassing mountable secrets policy.	CWE-20
spec.volumes[].secret.secretName	request body	/api/v1/namespaces/{namespace}/pods	Pod creation/manipulation to mount secrets via containers, bypassing mountable secrets policy.	CWE-20

17 Jun 2026 05:53Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

EPSS0.02157

SSVC

CWE-20