There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this
    issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet. (CVE-2023-2431)

An update of the kubernetes package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a1d7a29fe5 advisory.

    Patch update to Kubernetes 1.25 for Fedora 37. Primarily a security fix for CVE-2023-2431: Bypass of     seccomp profile enforcement.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2691-1 advisory.

    - CVE-2023-2431: Fixed a bypass issue of seccomp profile enforcement (bsc#1212493).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02423-2 advisory.

    - CVE-2021-25743: Escape terminal special characters in kubectl output (bsc#1194400).
    - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement (bsc#1212493).
    - CVE-2024-0793: Advance autoscaling v2 as the preferred API version (bsc#1219964).
    - CVE-2024-3177: Prevent bypassing mountable secrets policy imposed by the ServiceAccount admission plugin     (bsc#1222539).
    - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content     (bsc#1241865).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c7f63322b5 advisory.

    Upstream security update with additional bugfixes. Resolves CVE-2023-2431.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0872 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2021-25749:
    Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option     to true.

    CVE-2022-3172:
    A security issue was discovered in kube-apiserver that allows an     aggregated API server to redirect client traffic to any URL.  This could      lead to the client performing unexpected actions as well as forwarding     the client's API server credentials to third parties.

    CVE-2022-3294:
    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server/'s private network.

    CVE-2023-2431:
    A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this     issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet.

    CVE-2023-2728:
    Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service accounts secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers.

    CVE-2023-2727:
    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this     issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet. (CVE-2023-2431)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
420427	SCA: security update for k8s.io/kubernetes (GHSA-xc8m-28vv-4pjc)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
420427	SCA: security update for k8s.io/kubernetes (GHSA-xc8m-28vv-4pjc)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	critical
204440	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
177851	Fedora 37 : kubernetes (2023-a1d7a29fe5)	Nessus	Fedora Local Security Checks	7/1/2023	11/14/2024	medium
177718	SUSE SLES15: kubernetes1.23-apiserver / kubernetes1.23-client / etc (SUSE-SU-2023:2691-1)	Nessus	SuSE Local Security Checks	6/29/2023	6/25/2026	medium
278691	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2025:02423-2)	Nessus	SuSE Local Security Checks	12/15/2025	12/15/2025	medium
177649	Fedora 38 : kubernetes (2023-c7f63322b5)	Nessus	Fedora Local Security Checks	6/27/2023	11/14/2024	medium
239505	TencentOS Server 4: kubernetes (TSSA-2024:0872)	Nessus	Tencent Local Security Checks	6/16/2025	12/4/2025	high
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
250878	Linux Distros Unpatched Vulnerability : CVE-2023-2431	Nessus	Misc.	8/18/2025	7/21/2026	medium
203746	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical

Detections

Analytics

Plugins Search

medium

medium

critical

critical

medium

medium

medium

medium

high

critical

medium

critical