CVE-2023-2728: Kubernetes Auth Bypass Vulnerability

CVE-2023-2728 Overview

CVE-2023-2728 is an authorization bypass vulnerability in Kubernetes that allows users to launch containers that circumvent the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The vulnerability undermines a critical security control designed to ensure that pods running with a service account may only reference secrets explicitly specified in the service account's secrets field.

Critical Impact

Attackers with high privileges can bypass secrets access controls, potentially gaining unauthorized access to sensitive credentials and configuration data within Kubernetes clusters.

Affected Products

• Kubernetes (multiple versions)
• Kubernetes clusters using ServiceAccount admission plugin with kubernetes.io/enforce-mountable-secrets annotation
• Environments utilizing ephemeral containers feature

Discovery Timeline

• July 3, 2023 - CVE-2023-2728 published to NVD
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2023-2728

Vulnerability Analysis

This vulnerability represents an improper input validation flaw (CWE-20) in Kubernetes' ServiceAccount admission controller. The core issue lies in how the admission plugin handles ephemeral container specifications differently from regular container definitions. While the plugin correctly validates and restricts secret mounts for standard containers against the service account's allowed secrets list, it fails to apply the same validation logic when processing ephemeral containers.

The vulnerability specifically affects Kubernetes clusters where administrators have explicitly configured the kubernetes.io/enforce-mountable-secrets annotation to restrict which secrets a service account can access. This annotation is a security hardening measure intended to implement the principle of least privilege for secret access.

Root Cause

The root cause stems from an oversight in the ServiceAccount admission plugin's validation logic. When ephemeral containers were added to Kubernetes as a debugging feature, the admission controller's secret validation pathway was not updated to handle this new container type. As a result, ephemeral container specifications bypass the mountable secrets policy checks entirely, creating a gap in the security boundary that the annotation was designed to enforce.

Attack Vector

The attack vector requires network access and high privileges within the Kubernetes cluster. An attacker with the ability to create or modify pods with ephemeral containers can exploit this vulnerability to:

1. Create an ephemeral container specification that references secrets not allowed by the service account's mountable secrets policy
2. Have the pod admitted by the cluster despite violating the intended security policy
3. Access sensitive secrets that should have been restricted from the service account

The vulnerability is exploitable when an attacker adds an ephemeral container to an existing pod or creates a new pod specification that includes ephemeral containers referencing unauthorized secrets. The ServiceAccount admission plugin fails to validate secret references within the ephemeral container specification, allowing the pod to be created with access to restricted secrets.

Detection Methods for CVE-2023-2728

Indicators of Compromise

• Pods with ephemeral containers mounting secrets not listed in the associated service account's secrets field
• Audit log entries showing ephemeral container additions with unexpected secret volume mounts
• Unusual secret access patterns from pods that should have restricted secret access
• Service accounts with kubernetes.io/enforce-mountable-secrets annotation showing unexpected secret usage

Detection Strategies

• Enable and monitor Kubernetes audit logs for ephemeral container creation events
• Implement admission webhooks to validate ephemeral container secret references against service account policies
• Use OPA/Gatekeeper or Kyverno policies to enforce secret restrictions on ephemeral containers
• Deploy runtime security monitoring to detect unexpected secret access patterns

Monitoring Recommendations

• Configure alerting on audit events for kubectl debug commands and ephemeral container additions
• Monitor for pods in namespaces with sensitive secrets that suddenly gain ephemeral containers
• Track secret access events correlated with ephemeral container creation timestamps
• Implement SentinelOne Singularity for Kubernetes to monitor container runtime behavior and detect policy violations

How to Mitigate CVE-2023-2728

Immediate Actions Required

• Upgrade Kubernetes to a patched version that addresses CVE-2023-2728
• Review existing pods with ephemeral containers for unauthorized secret access
• Audit service accounts using the kubernetes.io/enforce-mountable-secrets annotation
• Consider temporarily restricting ephemeral container creation via RBAC until patches are applied

Patch Information

Kubernetes has released patches addressing this vulnerability. Organizations should consult the Kubernetes Security Announcement for specific version information and upgrade guidance. Additional details are available in the GitHub Kubernetes Issue Discussion and the NetApp Security Advisory.

Workarounds

• Restrict RBAC permissions for creating ephemeral containers to trusted users only
• Implement admission webhook policies that validate ephemeral container secret mounts against service account restrictions
• Use Pod Security Policies or Pod Security Standards to limit ephemeral container capabilities
• Consider disabling ephemeral containers cluster-wide if the feature is not required for debugging workflows

# Restrict ephemeral container creation via RBAC
# Create a ClusterRole that denies ephemeral container updates
kubectl create clusterrole deny-ephemeral-containers \
  --verb=update \
  --resource=pods/ephemeralcontainers \
  --dry-run=client -o yaml

# Verify service accounts with enforce-mountable-secrets annotation
kubectl get serviceaccounts -A -o json | \
  jq '.items[] | select(.metadata.annotations["kubernetes.io/enforce-mountable-secrets"]=="true") | .metadata.name'