CVE-2023-2727

Bypassing policies imposed by the ImagePolicyWebhook admission plugin

Published Jul 3, 2023 CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Description
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Remediation

Vendor Solution

To mitigate this vulnerability, upgrade Kubernetes: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster


Vendor Workaround

Prior to upgrading, this vulnerability can be mitigated by running validation webhooks (such as Gatekeeper and Kyverno) to enforce the same restrictions for ephemeral containers.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-2130 Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Github GHSA Github GHSA GHSA-qc2g-gmh6-95p4 kube-apiserver vulnerable to policy bypass
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00174}

epss

{'score': 0.00179}

Type Values Removed Values Added
Description Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
kubernetes
Published
Updated
Feb 13, 2025, 4:45 PM
Reserved
May 16, 2023, 12:31 AM
Status
Modified
Published
Jul 3, 2023, 9:15 PM
Modified
Jun 17, 2026, 5:53 AM
Severity
Moderate
Public date
Jun 15, 2023, 4:00 AM