VDB

GHSA-q78c-gwqw-jcmc

GHSA-q78c-gwqw-jcmc PUBLISHED CVSS 8.800000190734863 HIGH

Kubernetes privilege escalation vulnerability

Record from GitHub Advisory Database · Published October 31, 2023

k8s.io/kubernetes is fixed in 1.28.1, 1.27.5, 1.26.8 and 2 more (Go Modules)

Kubernetes privilege escalation vulnerability

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
k8s.io/kubernetesGo Modules1.28.1, 1.27.5, 1.26.8, 1.25.13, 1.24.17
aws-efs-csi-driver-fips-1.6Chainguard1.6.0-r5
aws-efs-csi-driverWolfi1.7.0-r6
aws-ebs-csi-driver-1.18Chainguard1.18.0-r8
cluster-autoscaler-fips-1.28Chainguard1.28.0-r5
calico-fips-3.25Chainguard3.25.2-r5
argo-cd-2.8Wolfi2.8.6-r1
aws-efs-csi-driverChainguard1.7.0-r6
calicoWolfi3.26.3-r5
kubeflow-pipelinesChainguard2.14.3-r3
calicoChainguard3.26.3-r5
cluster-autoscaler-1.25Chainguard1.25.3-r4

8 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersions
chainguardaws-efs-csi-driver-fips-1.60
wolfiaws-efs-csi-driver0
chainguardaws-ebs-csi-driver-1.180
chainguardcluster-autoscaler-fips-1.280
chainguardcalico-fips-3.250
wolfispark-operator*
wolfiargo-cd-2.80
chainguardkubernetes-dns-node-cache-1.17*
chainguardaws-efs-csi-driver0
wolficalico0
chainguardkubeflow-pipelines0
chainguardspark-operator*
chainguardcalico0
chainguardcalico-fips*
chainguardsecrets-store-csi-driver*
chainguardcluster-autoscaler-1.250
chainguardaws-efs-csi-driver-fips0
wolfikubeflow-pipelines0
chainguardsecrets-store-csi-driver-fips*
chainguardargo-cd-2.70

…and 9 more

Timeline

  • Oct 31, 2023 CVE Published
  • Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-q78c-gwqw-jcmc
vulnetix vdb fixes GHSA-q78c-gwqw-jcmc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-q78c-gwqw-jcmc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›