CLEANSTART-2026-ZC85272: Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker needs high privileges and can exploit the issue over the network. No user interaction is required.

Q: What is the expected impact if exploitation succeeds?

The vulnerability is rated as having high confidentiality and integrity impact. The supplied CVSS vector indicates no availability impact.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-2728

Frequently Asked Questions

What level of access does an attacker need?

The CVSS vector indicates that an attacker needs high privileges and can exploit the issue over the network. No user interaction is required.

What is the expected impact if exploitation succeeds?

The vulnerability is rated as having high confidentiality and integrity impact. The supplied CVSS vector indicates no availability impact.

CLEANSTART-2026-ZC85272: Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?