CVE-2023-23939
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
Published Mar 7, 2023 · updated Sep 10, 2026
### Impact This vulnerability only impacts versions and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalation to the user that can also run kubectl, most likely root. This attack is only possible if an attacker somehow breached the GitHub actions runner or if a user is utilizing an Action that maliciously executes this attack. No impacted customers have been reported. ### Patches This has been fixed and released in all versions and later. 755 permissions are used instead. ### Workarounds If users absolutely cannot upgrade to or higher than they should be extra diligent of the other GitHub actions they are using in a workflow and ensure that their GitHub actions runner is secure.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 7, 2023 · GitHub Advisory Database
Detected
### Impact This vulnerability only impacts versions and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalat
Sep 10, 2026 · GitHub Advisory Database
Fix available
Azure/setup-kubectl fixed in 3
Sep 10, 2026 · GitHub Advisory Database
Fix available
Azure/setup-kubectl fixed in 3
Sep 10, 2026 · GitHub Advisory Database
Updated
### Impact This vulnerability only impacts versions and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalat
Affected
- GitHub Actions Azure/setup-kubectl0 → 3
Sources
- CVE.orgVulnerability recordCVE-2023-23939
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-p756-rfxh-x63h
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryGHSA-p756-rfxh-x63h
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
osv.dev