VDB
GO-2023-1793
GO-2023-1793
PUBLISHED
secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | vault-csi-provider | 0, 0 |
| sigs.k8s.io | secrets-store-csi-driver | 0, 0 |
| wolfi | secrets-store-csi-driver | 0, 0, 0 |
| chainguard | secrets-store-csi-driver | 0, 0 |
Timeline
- Aug 20, 2024 CVE Published
- Feb 4, 2026 CVE Updated
- May 1, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-2878 advisory
- https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ url
- https://security.netapp.com/advisory/ntap-20230814-0003 url
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/security/advisories/GHSA-g82w-58jf-gcxx advisory
- https://github.com/kubernetes-sigs/secrets-store-csi-driver/releases/tag/v1.3.3 fix
- https://github.com/kubernetes/kubernetes/issues/118419 discussion