CubeFS allows Kubernetes cluster-level privilege escalation

MEDIUM 6.5CVE-2023-30512 · GHSA-9337-8c6c-c2xg · Published 12/04/2023 · updated 17/06/2026

In short

CVE-2023-30512 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/cubefs/cubefs, cubefs (linuxfoundation).
Chance of exploitation in the next 30 days (EPSS): 0.51%, higher than 43.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/cubefs/cubefs Go	`≤ 3.2.1`	No fix yet
cubefs linuxfoundation	`≤ 3.2.1`	No fix yet

Description

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.

NVD description

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.

References

nvd.nist.gov/vuln/detail/CVE-2023-30512 · ADVISORY
cubefs/cubefs · WEB
cubefs/cubefs · PACKAGE

More vulnerabilities in github.com/cubefs/cubefs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/cubefs/cubefs

≤ 3.2.1

No fix yet

cubefs

linuxfoundation

≤ 3.2.1

No fix yet

Description

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.

NVD description

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.

More vulnerabilities in github.com/cubefs/cubefs

See all →