StackRadar

CVE-2023-3955

High

Advisory

Published 31 Oct 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.031
87th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
183
of 17,787 indexed, latest versions
Container images
159
deployed by those charts
Fix available
2 of 2
affected packages

Kubernetes privilege escalation vulnerability

Carried by container images the latest versions of 183 of 17,787 indexed charts deploy, on 159 images.

Affected packageAffected versionsFixed inImages
k8s.io/kubernetesgolangv0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+79 more1.24.17, 1.25.13, 1.26.8, 1.27.5+1 more151
k8s.io/mount-utilsgolangv0.20.0, v0.20.0-alpha.1, v0.20.1-rc.0, v0.21.0-alpha.0+14 more0.24.1722
OSV records
GHSA-q78c-gwqw-jcmcGO-2023-2170

Charts affected

183 by stars
ChartLatestAffected imagesRadar Score
nfs-subdir-external-provisionernfs-subdir-external-provisioner4.0.181 of 1See more

nfs-subdir-external-provisioner nfs-subdir-external-provisioner 4.0.18

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
k8s.io/kubernetes@v1.18.0
1.24.17

Open the chart page →

2,745
jupyterhubjupyterhubOfficialVerified publisher4.4.21 of 7See more

jupyterhub jupyterhub 4.4.2

1 of the 7 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kube-scheduler:v1.30.1474a5cf9cfa9f
k8s.io/kubernetes@v0.0.0-20250617182919-9e1848391882
1.24.17

Open the chart page →

7,909
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
rancher/kubectl:v1.25.085a0d1148784
k8s.io/kubernetes@v1.25.0
1.25.13

Open the chart page →

9,869
aws-ebs-csi-driverdeliveryheroVerified publisher2.17.41 of 6See more

aws-ebs-csi-driver deliveryhero 2.17.4

1 of the 6 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.16.11564359e1e0e
k8s.io/kubernetes@v1.26.0
k8s.io/mount-utils@v0.26.0
1.26.8
0.24.17

Open the chart page →

6,485
csi-secrets-store-provider-azurecsi-secrets-store-provider-azureVerified publisher1.8.21 of 5See more

csi-secrets-store-provider-azure csi-secrets-store-provider-azure 1.8.2

1 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.65f91243cfd60
k8s.io/mount-utils@v0.26.4
0.24.17

Open the chart page →

2,235
devtron-operatordevtron0.23.31 of 11See more

devtron-operator devtron 0.23.3

1 of the 11 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
k8s.io/kubernetes@v1.25.2
1.25.13

Open the chart page →

31,447
emqx-operatoremqx-operator2.3.21 of 2See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
alpine/k8s:1.31.49c4976d47656
k8s.io/kubernetes@v0.0.0-20241210113726-a78aa47129b8
1.24.17

Open the chart page →

4,532
sops-operatorsops-operatorVerified publisher0.10.11 of 2See more

sops-operator sops-operator 0.10.1

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,250
csi-wekafsplugincsi-wekafsOfficialVerified publisher0.6.2-01 of 6See more

csi-wekafsplugin csi-wekafs 0.6.2-0

1 of the 6 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/k8scsi/csi-node-driver-registrar:v1.3.0e6df72478956
k8s.io/kubernetes@v1.11.0-beta.2
1.24.17

Open the chart page →

2,824
geonode-k8sgeonode-k8sVerified publisher2.0.01 of 10See more

geonode-k8s geonode-k8s 2.0.0

1 of the 10 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.32.08ccae74fc039
k8s.io/kubernetes@v0.0.0-20241211175915-70d3cc986aa8
1.24.17

Open the chart page →

14,043
kubeflowkubeflow1.6.24 of 45See more

kubeflow kubeflow 1.6.2

4 of the 45 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/api-server:2.0.0-alpha.5dc6ca05bb94f
k8s.io/kubernetes@v1.11.1
1.24.17
gcr.io/ml-pipeline/cache-server:2.0.0-alpha.583e79c709df3
k8s.io/kubernetes@v1.11.1
1.24.17
gcr.io/ml-pipeline/persistenceagent:2.0.0-alpha.500db9796a37b
k8s.io/kubernetes@v1.11.1
1.24.17
gcr.io/ml-pipeline/scheduledworkflow:2.0.0-alpha.5795a0c8a0e13
k8s.io/kubernetes@v1.11.1
1.24.17

Open the chart page →

97,040
vclustermainVerified publisher0.17.03 of 10See more

vcluster main 0.17.0

3 of the 10 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
k8s.io/kubernetes@v1.25.0
1.25.13
registry.k8s.io/kube-controller-manager:v1.25.066ce7d460e53
k8s.io/kubernetes@v1.25.0
1.25.13
registry.k8s.io/kube-scheduler:v1.25.09330c53feca7
k8s.io/kubernetes@v1.25.0
1.25.13

Open the chart page →

11,556
capsuleprojectcapsuleOfficialVerified publisher0.14.51 of 2See more

capsule projectcapsule 0.14.5

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,231
rke2-multusrke2-charts3.7.1-build20210416011 of 2See more

rke2-multus rke2-charts 3.7.1-build2021041601

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
rancher/hardened-multus-cni:v3.7.1-build202104168eb8092f0728
k8s.io/kubernetes@v1.13.0
1.24.17

Open the chart page →

4,519
yataibentomlVerified publisher1.1.131 of 1See more

yatai bentoml 1.1.13

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai:1.1.13a5dc9d91de0d
k8s.io/kubernetes@v1.25.9
1.25.13

Open the chart page →

1,917
core-dump-handlercore-dump-handler9.0.01 of 1See more

core-dump-handler core-dump-handler 9.0.0

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/icdh/core-dump-handler:v9.0.0cc79b9e2a1c8
k8s.io/kubernetes@v1.22.0
1.24.17

Open the chart page →

3,081
multusgeek-cookbookVerified publisher3.5.21 of 3See more

multus geek-cookbook 3.5.2

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v3.7.1e72aa733faf2
k8s.io/kubernetes@v1.13.0
1.24.17

Open the chart page →

4,908
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:v2.0c14d7271e401
k8s.io/kubernetes@v1.25.4
1.25.13

Open the chart page →

30,920
karporkusionstackVerified publisher0.7.61 of 3See more

karpor kusionstack 0.7.6

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
kusionstack/karpor:v0.6.4b707d3bf0abd
k8s.io/kubernetes@v1.26.1
k8s.io/mount-utils@v0.26.1
1.26.8
0.24.17

Open the chart page →

3,297
loftloftVerified publisher0.0.0-ci.141 of 1See more

loft loft 0.0.0-ci.14

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
k8s.io/kubernetes@v1.28.0
1.28.1

Open the chart page →

3,677
vcluster-k8sloftVerified publisher0.0.0-ci.32 of 4See more

vcluster-k8s loft 0.0.0-ci.3

2 of the 4 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
k8s.io/kubernetes@v1.26.1
1.26.8
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
k8s.io/kubernetes@v1.26.1
1.26.8

Open the chart page →

5,574
veleromesosphere3.2.51 of 1See more

velero mesosphere 3.2.5

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.26.4a0a972324d93
k8s.io/kubernetes@v1.26.4
1.26.8

Open the chart page →

1,871
kubecostmesosphere-stable0.37.51 of 9See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.30.5744f84cf7493
k8s.io/kubernetes@v0.0.0-20240912001154-74e84a90c725
1.24.17

Open the chart page →

17,755
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
k8s.io/kubernetes@v1.24.2
1.24.17

Open the chart page →

3,794
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
k8s.io/kubernetes@v1.25.9
1.25.13

Open the chart page →

107,899
argocdtwomartensVerified publisher0.1.11 of 3See more

argocd twomartens 0.1.1

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v2.8.6acaf37352569
k8s.io/kubernetes@v1.24.2
1.24.17

Open the chart page →

10,355
yataiyataiVerified publisher0.4.61 of 2See more

yatai yatai 0.4.6

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai:0.4.614b482c1f1b8
k8s.io/kubernetes@v1.13.4
1.24.17

Open the chart page →

4,041
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
k8s.io/kubernetes@v0.0.0-20250909225156-c601ba40fa8f
1.24.17

Open the chart page →

14,920
argocd-backup-s3argocd-backup-s3Verified publisher0.9.51 of 1See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
k8s.io/kubernetes@v1.23.1
1.24.17

Open the chart page →

5,231
capsulecapsuleOfficialVerified publisher0.14.51 of 2See more

capsule capsule 0.14.5

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,231
capsule-proxycapsule-proxyOfficialVerified publisher0.14.11 of 2See more

capsule-proxy capsule-proxy 0.14.1

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

1,224
chatclichatcliVerified publisher1.204.01 of 2See more

chatcli chatcli 1.204.0

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.10e0b2d217d1d2
k8s.io/kubernetes@v0.0.0-20250617183334-61183587c03f
1.24.17

Open the chart page →

1,028
datadogdatadog-test2.4.231 of 2See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
datadog/agent:7.22.08f20e56b5311
k8s.io/kubernetes@v1.16.2
1.24.17

Open the chart page →

4,570
calicodevtron0.1.11 of 4See more

calico devtron 0.1.1

1 of the 4 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
quay.io/devtron/calico-networking:node-v3.19.1bc4aa22272ef
k8s.io/kubernetes@v1.21.0-rc.0
1.24.17

Open the chart page →

10,073
ipfs-clusterethereum-helm-chartsVerified publisher0.1.141 of 3See more

ipfs-cluster ethereum-helm-charts 0.1.14

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
lachlanevenson/k8s-kubectl:v1.25.4af5cea3f2e40
k8s.io/kubernetes@v1.25.4
1.25.13

Open the chart page →

4,616
fsmfsmOfficialVerified publisher0.2.112 of 5See more

fsm fsm 0.2.11

2 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
flomesh/fsm-ingress-pipy:0.2.11cc39c96711c4
k8s.io/kubernetes@v1.26.5
1.26.8
flomesh/fsm-manager:0.2.1122f849c70b25
k8s.io/kubernetes@v1.26.5
1.26.8

Open the chart page →

4,219
ks-corekubeblocksVerified publisher1.1.31 of 5See more

ks-core kubeblocks 1.1.3

1 of the 5 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
kubesphere/kubectl:v1.27.1649b445b1b732
k8s.io/kubernetes@v0.0.0-20240717014424-cbb86e0d7f4a
1.24.17

Open the chart page →

4,723
kubegems-installerkubegemsOfficial1.24.101 of 1See more

kubegems-installer kubegems 1.24.10

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
kubegems/kubegems:v1.24.10a730bcf9322a
k8s.io/kubernetes@v1.23.1
k8s.io/mount-utils@v0.23.5
1.24.17
0.24.17

Open the chart page →

3,381
kubegems-localkubegemsOfficial1.24.102 of 2See more

kubegems-local kubegems 1.24.10

2 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
kubegems/kubectl:latestc3b4be9a54f5
k8s.io/kubernetes@v1.26.1
1.26.8
kubegems/kubegems:v1.24.10a730bcf9322a
k8s.io/kubernetes@v1.23.1
k8s.io/mount-utils@v0.23.5
1.24.17
0.24.17

Open the chart page →

6,090
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
k8s.io/kubernetes@v1.26.3
1.26.8

Open the chart page →

3,275
aws-efs-csi-driverkubesphere-testVerified publisher0.1.01 of 3See more

aws-efs-csi-driver kubesphere-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
amazon/aws-efs-csi-driver:v0.3.0b55277652ea8
k8s.io/kubernetes@v1.16.1
1.24.17

Open the chart page →

2,605
kubeservice-cpupools-controllerkubservice-chartsVerified publisher0.1.12 of 2See more

kubeservice-cpupools-controller kubservice-charts 0.1.1

2 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
dongjiang1989/cpusets-controller:v1.1.1dc5bd483874c
k8s.io/kubernetes@v1.26.6
1.26.8
dongjiang1989/cpusets-device-plugin:v1.1.1923085c65123
k8s.io/kubernetes@v1.26.6
1.26.8

Open the chart page →

3,122
kubeservice-scheduler-pluskubservice-chartsVerified publisher0.2.11 of 2See more

kubeservice-scheduler-plus kubservice-charts 0.2.1

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
dongjiang1989/crane-scheduler-controller:mainf0055c05dbee
k8s.io/kubernetes@v1.25.7
1.25.13

Open the chart page →

1,803
kube-fencingkvaps2.4.11 of 2See more

kube-fencing kvaps 2.4.1

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/kvaps/kube-fencing-controller:v2.4.0313edfec2fca
k8s.io/kubernetes@v1.25.3
1.25.13

Open the chart page →

2,538
linstorkvaps1.14.02 of 11See more

linstor kvaps 1.14.0

2 of the 11 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/kvaps/linstor-csi:v1.14.0087618d16b83
k8s.io/kubernetes@v1.14.10
1.24.17
ghcr.io/kvaps/linstor-stork:v1.14.05e409a6332b4
k8s.io/kubernetes@v1.20.4
1.24.17

Open the chart page →

15,551
vcluster-k0sloftVerified publisher0.0.0-ci.31 of 2See more

vcluster-k0s loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
k8s.io/kubernetes@v1.26.0
k8s.io/mount-utils@v0.26.0
1.26.8
0.24.17

Open the chart page →

3,138
oadaoadaVerified publisher5.0.51 of 11See more

oada oada 5.0.5

1 of the 11 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
k8s.io/kubernetes@v1.25.4
1.25.13

Open the chart page →

13,319
rke2-canalrke2-charts3.13.31 of 2See more

rke2-canal rke2-charts 3.13.3

1 of the 2 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
rancher/hardened-calico:v3.13.36d2cd61a338b
k8s.io/kubernetes@v1.16.2
1.24.17

Open the chart page →

6,996
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.24.17

Open the chart page →

11,545
guardrails-agent-kubernetesturbotVerified publisher0.3.01 of 1See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-3955.

Container imageDigestPackageFixed in
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
k8s.io/kubernetes@v0.0.0-20241119134819-c83cbee114dd
1.24.17

Open the chart page →

4,061

Container images carrying it

159 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
k8s.io/kubernetes@v1.25.0
1.25.13
1
registry.k8s.io/kube-controller-manager:v1.25.066ce7d460e53
k8s.io/kubernetes@v1.25.0
1.25.13
1
registry.k8s.io/kubectl:v1.32.73c5268158974
k8s.io/kubernetes@v0.0.0-20250715180032-158eee9fac88
1.24.17
1
registry.k8s.io/kubectl:v1.32.08ccae74fc039
k8s.io/kubernetes@v0.0.0-20241211175915-70d3cc986aa8
1.24.17
1
registry.k8s.io/kubectl:v1.31.10e0b2d217d1d2
k8s.io/kubernetes@v0.0.0-20250617183334-61183587c03f
1.24.17
1
registry.k8s.io/kube-scheduler:v1.28.1146cf7475c8da
k8s.io/kubernetes@v0.0.0-20240611201126-f25b321b9ae4
1.24.17
1
registry.k8s.io/kube-scheduler:v1.25.09330c53feca7
k8s.io/kubernetes@v1.25.0
1.25.13
1
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
k8s.io/kubernetes@v1.20.0
k8s.io/mount-utils@v0.20.1-rc.0
1.24.17
0.24.17
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
k8s.io/kubernetes@v1.18.0
1.24.17
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.