CVE-2023-1260

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

VendorProductVersions
———
Red HatRed Hat OpenShift Container Platform 4.10—
Red HatRed Hat OpenShift Container Platform 4.11—
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—

References

Timeline

Published
Sep 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-12615.3Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.CVE-2023-12625.3Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages tCVE-2023-12635.3The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via CVE-2023-12645.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.CVE-2023-12654.5An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.1CVE-2023-12679.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue CVE-2023-12699.8Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-12705.4Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.CVE-2023-12738.8The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to inclCVE-2023-12746.5The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attribuCVE-2023-12756.1A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects unCVE-2023-12767.2A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file app