CVE-2023-3893

—

CVSS 3.1

8.8 high

EPSS

3%p85

Published

Nov 3, 2023 (Nov 3, 2023)

Modified

Jun 17, 2026

Description

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy.

Vendors: kubernetes
Products: csi proxy
Weakness: CWE-20
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news4 stories

Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE

Help Net SecuritySep 24, 00:00 UTC · Sep 24, 2023Vulnerability in the wildCVE-2023-41179 CVE-2023-41992 CVE-2023-41991+6 CVEs

Kubernetes vulnerability allows RCE on Windows endpoints (CVE-2023-3676)

Help Net SecurityJan 9, 12:29 UTC · Jan 9, 2024Vulnerability CVE-2023-3676 CVE-2023-3893 CVE-2023-39551

Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2023Vulnerability CVE-2023-3676 CVE-2023-3893 CVE-2023-39551

Kubernetes flaws could lead to remote code execution on Windows endpoints

Security AffairsSep 14, 07:18 UTC · Sep 14, 2023Vulnerability CVE-2023-3676 CVE-2023-3893 CVE-2023-3955