StackRadar

CVE-2023-3955

High

Advisory

Published 31 Oct 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.031
87th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
176
of 17,781 indexed, latest versions
Container images
153
deployed by those charts
Fix available
2 of 2
affected packages

Kubernetes privilege escalation vulnerability

Carried by container images the latest versions of 176 of 17,781 indexed charts deploy, on 153 images.

Affected packageAffected versionsFixed inImages
k8s.io/kubernetesgolangv0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+78 more1.24.17, 1.25.13, 1.26.8, 1.27.5+1 more145
k8s.io/mount-utilsgolangv0.20.0, v0.20.0-alpha.1, v0.20.1-rc.0, v0.21.0-alpha.0+12 more0.24.1720
OSV records
GHSA-q78c-gwqw-jcmcGO-2023-2170

Charts affected

176 by stars
ChartLatestAffected imagesRadar Score
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
k8s.io/kubernetes@v1.25.5
1.25.13

Open the chart page →

12,949
calicoromholdings0.1.11 of 4See more

calico romholdings 0.1.1

1 of the 4 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/calico-networking:node-v3.19.1bc4aa22272ef
k8s.io/kubernetes@v1.21.0-rc.0
1.24.17

Open the chart page →

10,071
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/inception:7beef376-948-313784c3b91bebd3d
k8s.io/kubernetes@v1.20.4
1.24.17
quay.io/devtron/kubectl:latest2ad610626658
k8s.io/kubernetes@v1.25.2
1.25.13

Open the chart page →

68,240
devtron-in-clustercdromholdings0.10.21 of 2See more

devtron-in-clustercd romholdings 0.10.2

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
k8s.io/kubernetes@v1.24.2
1.24.17

Open the chart page →

5,039
devtron-logs-dumpromholdings0.1.01 of 1See more

devtron-logs-dump romholdings 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/k8s-utils:807ca3c2-488-14005f296c2ec5db7
k8s.io/kubernetes@v1.27.2
1.27.5

Open the chart page →

4,928
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
k8s.io/kubernetes@v1.25.2
1.25.13

Open the chart page →

32,902
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
k8s.io/kubernetes@v1.25.5
1.25.13

Open the chart page →

4,881
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
leonardomulticloud/webhook:v1.0.0d119918900e8
k8s.io/kubernetes@v0.0.0-20240911212207-948afe5ca072
1.24.17

Open the chart page →

5,497
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
k8s.io/kubernetes@v1.24.14
1.24.17

Open the chart page →

2,314
octavia-ingress-controllerslamdev0.0.71 of 1See more

octavia-ingress-controller slamdev 0.0.7

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
k8scloudprovider/octavia-ingress-controller:v1.20.26ddf80b34265
k8s.io/mount-utils@v0.20.0
0.24.17

Open the chart page →

2,761
kyvernosoftonic3.5.21 of 7See more

kyverno softonic 3.5.2

1 of the 7 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.32.73c5268158974
k8s.io/kubernetes@v0.0.0-20250715180032-158eee9fac88
1.24.17

Open the chart page →

1,019
gloo-meshsolo-gloo-mesh1.1.21 of 1See more

gloo-mesh solo-gloo-mesh 1.1.2

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
k8s.io/kubernetes@v1.13.0
1.24.17

Open the chart page →

3,257
spire-identity-exchangespiffeVerified publisher0.2.21 of 3See more

spire-identity-exchange spiffe 0.2.2

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.099b37df34bc4
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,427
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
gcr.io/kubecost1/server:prod-1.82.22b1a3d08caac
k8s.io/kubernetes@v1.14.1
1.24.17

Open the chart page →

16,506
nfs-provisionersupporttools0.11.01 of 1See more

nfs-provisioner supporttools 0.11.0

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
openebs/provisioner-nfs:0.11.04f41dd782761
k8s.io/kubernetes@v1.17.3
1.24.17

Open the chart page →

2,671
hcloud-csisyself0.1.11 of 6See more

hcloud-csi syself 0.1.1

1 of the 6 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
hetznercloud/hcloud-csi-driver:1.6.01475d525f9a4
k8s.io/mount-utils@v0.21.0-rc.0
0.24.17

Open the chart page →

2,910
tfy-inferentia-operatortruefoundryVerified publisher0.2.81 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
k8s.io/kubernetes@v0.0.0-20250108021927-cd1e1306b0ba
1.24.17

Open the chart page →

2,902
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
k8s.io/kubernetes@v0.0.0-20241119172634-0c76c645d5a6
1.24.17

Open the chart page →

8,607
vineyard-operatorvineyardVerified publisher0.24.21 of 2See more

vineyard-operator vineyard 0.24.2

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
vineyardcloudnative/vineyard-operator:latest9d419aa18faa
k8s.io/kubernetes@v1.19.3
k8s.io/mount-utils@v0.20.0-alpha.1
1.24.17
0.24.17

Open the chart page →

4,525
azure-scheduledevents-managerwebdevopsVerified publisher1.0.171 of 1See more

azure-scheduledevents-manager webdevops 1.0.17

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
webdevops/azure-scheduledevents-manager:24.9.0-kubernetes7acd46a8a972
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,122
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
k8s.io/kubernetes@v1.18.19
k8s.io/mount-utils@v0.22.2
1.24.17
0.24.17

Open the chart page →

15,230
nfs-subdir-external-provisionerwenerme4.0.181 of 1See more

nfs-subdir-external-provisioner wenerme 4.0.18

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
k8s.io/kubernetes@v1.18.0
1.24.17

Open the chart page →

2,743
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
k8s.io/kubernetes@v1.24.4
1.24.17

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
k8s.io/kubernetes@v1.24.4
1.24.17

Open the chart page →

11,784
csi-driver-host-pathwiremindVerified publisher0.1.11 of 8See more

csi-driver-host-path wiremind 0.1.1

1 of the 8 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
k8s.io/kubernetes@v1.20.0
k8s.io/mount-utils@v0.20.1-rc.0
1.24.17
0.24.17

Open the chart page →

12,606
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
k8s.io/kubernetes@v0.0.0-20241022202812-5864a4677267
1.24.17

Open the chart page →

13,677

Container images carrying it

153 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
dongjiang1989/cpusets-controller:v1.1.1dc5bd483874c
k8s.io/kubernetes@v1.26.6
1.26.8
1
dongjiang1989/cpusets-device-plugin:v1.1.1923085c65123
k8s.io/kubernetes@v1.26.6
1.26.8
1
dongjiang1989/crane-scheduler-controller:mainf0055c05dbee
k8s.io/kubernetes@v1.25.7
1.25.13
1
dserio83/velero-api:0.3.16b3d9115fee2
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
k8s.io/kubernetes@v1.26.2
1.26.8
1
flomesh/fsm-ingress-pipy:0.2.11cc39c96711c4
k8s.io/kubernetes@v1.26.5
1.26.8
1
flomesh/fsm-manager:0.2.1122f849c70b25
k8s.io/kubernetes@v1.26.5
1.26.8
1
gocrane/craned:v0.5.1a1400909118c
k8s.io/kubernetes@v1.22.3
k8s.io/mount-utils@v0.22.3
1.24.17
0.24.17
1
gocrane/crane-scheduler:0.0.239ba6d11b2079
k8s.io/kubernetes@v1.23.3
k8s.io/mount-utils@v0.23.3
1.24.17
0.24.17
1
gocrane/crane-scheduler-controller:0.1.23a2d7e60576f9
k8s.io/kubernetes@v1.23.3
1.24.17
1
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
k8s.io/kubernetes@v1.25.4
1.25.13
1
hammerspaceinc/csi-plugin:v1.2.8-rc2395bee4504fc
k8s.io/mount-utils@v0.27.4
0.24.17
1
hetznercloud/hcloud-csi-driver:1.6.01475d525f9a4
k8s.io/mount-utils@v0.21.0-rc.0
0.24.17
1
hetznercloud/hcloud-csi-driver:1.5.141dce5b33644
k8s.io/kubernetes@v1.17.12
1.24.17
1
hetznercloud/hcloud-csi-driver:v2.3.2b7ed90d5fab2
k8s.io/mount-utils@v0.23.9-rc.0
0.24.17
1
huzafach/aws-cli-k8:1.0.06e271d43ea48
k8s.io/kubernetes@v0.0.0-20240611202059-39683505b630
1.24.17
1
j0113/haven-compliancy-dashboard:1.3696cb8ca9f4e
k8s.io/kubernetes@v1.21.4
1.24.17
1
k8scloudprovider/cinder-csi-plugin:latesta30c7a2a594a
k8s.io/mount-utils@v0.24.0
0.24.17
1
k8scloudprovider/octavia-ingress-controller:v1.20.26ddf80b34265
k8s.io/mount-utils@v0.20.0
0.24.17
1
kubeedge/edgemesh-agent:latest460c6061b608
k8s.io/kubernetes@v1.23.0
1.24.17
1
kubesphere/kubectl:v1.27.1649b445b1b732
k8s.io/kubernetes@v0.0.0-20240717014424-cbb86e0d7f4a
1.24.17
1
kusionstack/karpor:v0.6.4b707d3bf0abd
k8s.io/kubernetes@v1.26.1
k8s.io/mount-utils@v0.26.1
1.26.8
0.24.17
1
kusionstack/kuperator:v0.7.4d2f72ae1d2f2
k8s.io/kubernetes@v1.22.6
1.24.17
1
kusionstack/operating:v0.5.0c28bd96b986b
k8s.io/kubernetes@v1.22.6
1.24.17
1
leonardomulticloud/webhook:v1.0.0d119918900e8
k8s.io/kubernetes@v0.0.0-20240911212207-948afe5ca072
1.24.17
1
longhornio/longhorn-manager:v1.2.3dca34321452c
k8s.io/kubernetes@v1.18.19
k8s.io/mount-utils@v0.22.2
1.24.17
0.24.17
1
longhornio/longhorn-manager:v1.1.1ede61fe2a472
k8s.io/kubernetes@v1.16.15
1.24.17
1
mesosphere/kommander-federation-authorizedlister:v0.21.263bc411b930b
k8s.io/kubernetes@v1.19.5
1.24.17
1
mesosphere/kommander-federation-controller-manager:v0.21.2b036785a8862
k8s.io/kubernetes@v1.19.5
1.24.17
1
mesosphere/kommander-federation-webhook:v0.21.294af41b6dd9a
k8s.io/kubernetes@v1.19.5
1.24.17
1
murtazashah46/helmfile:latest4d11726cf803
k8s.io/kubernetes@v0.0.0-20241022202812-5864a4677267
1.24.17
1
natsio/nats-operator:0.8.31261dae38389
k8s.io/kubernetes@v1.22.2
1.24.17
1
openebs/provisioner-nfs:0.11.04f41dd782761
k8s.io/kubernetes@v1.17.3
1.24.17
1
openpolicyagent/gatekeeper-crds:v3.17.177bc9bf3d163
k8s.io/kubernetes@v0.0.0-20240716234811-6fc0a69044f1
1.24.17
1
phntom/external-dns-host-network:0.0.123adadbac8443
k8s.io/kubernetes@v1.25.3
1.25.13
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
k8s.io/kubernetes@v1.16.2
1.24.17
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
k8s.io/kubernetes@v1.26.3
1.26.8
1
rancher/hardened-calico:v3.13.36d2cd61a338b
k8s.io/kubernetes@v1.16.2
1.24.17
1
rancher/hardened-calico:v3.13.3-build20210223c678c25d47c8
k8s.io/kubernetes@v1.16.2
1.24.17
1
rancher/hardened-multus-cni:v3.7.1-build202104168eb8092f0728
k8s.io/kubernetes@v1.13.0
1.24.17
1
rancher/kubectl:v1.25.085a0d1148784
k8s.io/kubernetes@v1.25.0
1.25.13
1
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
k8s.io/kubernetes@v1.25.5
1.25.13
1
sikalabs/slu:v0.72.07bd267f30247
k8s.io/kubernetes@v1.24.14
1.24.17
1
veecode/devportal-admin-ui:0.4.30c69fd286b489
k8s.io/kubernetes@v0.0.0-20240814185733-a51b3b711150
1.24.17
1
vineyardcloudnative/vineyard-operator:latest9d419aa18faa
k8s.io/kubernetes@v1.19.3
k8s.io/mount-utils@v0.20.0-alpha.1
1.24.17
0.24.17
1
webdevops/azure-scheduledevents-manager:24.9.0-kubernetes7acd46a8a972
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17
1
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
k8s.io/kubernetes@v1.13.0
1.24.17
1
gcr.io/kubecost1/server:prod-1.82.22b1a3d08caac
k8s.io/kubernetes@v1.14.1
1.24.17
1
gcr.io/kubecost1/server:prod-1.81.0a348db3e4d74
k8s.io/kubernetes@v1.14.1
1.24.17
1
gcr.io/ml-pipeline/api-server:2.3.039661bd823e8
k8s.io/kubernetes@v1.11.1
1.24.17
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.