Openshift: modification of node role labels

CVE-2023-5408

Summary

A privilege escalation vulnerability exists in the node restriction admission plugin of the Kubernetes API server within OpenShift. An unauthorized remote attacker could exploit this flaw by altering the node role label, enabling them to redirect workloads from the control plane and etcd nodes to different worker nodes. This exploitation can allow for unauthorized access to broader areas within the cluster, potentially compromising the integrity and security of the entire environment.

References