CVE-2023-2728 (published 2023-07-03T20:06:11.796Z)
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.


Affected products: Vendor: Kubernetes
Product: Kubernetes
Versions: v1.24.14, v1.25.0 - v1.25.10, v1.26.0 - v1.26.5, v1.27.0 - v1.27.2