CVE-2023-29018

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

VendorProductVersions
open-featureopen-feature-operator< 0.2.32

References

Timeline

Published
Apr 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-290198.1@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affectedCVE-2023-29026.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unkCVE-2023-290206.5@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enCVE-2023-290225.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290236.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290246.5A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability waCVE-2023-290255.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290265.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290275.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290285.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290295.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-29036.5A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the f
CVE-2023-29018: High severity, CVSS 8.8 | Vulnix