CVE-2023-30840

Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior to version 0.8.6, if a malicious user gains control of a Kubernetes node running fluid csi pod (controlled by the `csi-nodeplugin-fluid` node-daemonset), they can leverage the fluid-csi service account to modify specs of all the nodes in the cluster. However, since this service account lacks `list node` permissions, the attacker may need to use other techniques to identify vulnerable nodes. Once the attacker identifies and modifies the node specs, they can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes. This allows them to elevate privileges beyond the compromised node and potentially gain full privileged access to the whole cluster. To exploit this vulnerability, the attacker can make all other nodes unschedulable (for example, patch node with taints) and wait for system-critical components with high privilege to appear on the compromised node. However, this attack requires two prerequisites: a compromised node and identifying all vulnerable nodes through other means. Version 0.8.6 contains a patch for this issue. As a workaround, delete the `csi-nodeplugin-fluid` daemonset in `fluid-system` namespace and avoid using CSI mode to mount FUSE file systems. Alternatively, using sidecar mode to mount FUSE file systems is recommended.

• CWE-863

• https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550Patch
• https://github.com/fluid-cloudnative/fluid/commit/91c05c32db131997b5ca065e869c9918a125c149Patch
• https://github.com/fluid-cloudnative/fluid/releases/tag/v0.8.6Release Notes
• https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-93xx-cvmc-9w3vMitigation, Patch, Vendor Advisory
• https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550Patch
• https://github.com/fluid-cloudnative/fluid/commit/91c05c32db131997b5ca065e869c9918a125c149Patch
• https://github.com/fluid-cloudnative/fluid/releases/tag/v0.8.6Release Notes
• https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-93xx-cvmc-9w3vMitigation, Patch, Vendor Advisory

Published

May 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3082The Post SMTP plugin for WordPress is vulnerable to Stored C…6.1
• CVE-2023-3083Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.7
• CVE-2023-30837Vyper is a pythonic smart contract language for the EVM. The…7.5
• CVE-2023-30838PrestaShop is an Open Source e-commerce web application. Pri…9.9
• CVE-2023-30839PrestaShop is an Open Source e-commerce web application. Ver…8.8
• CVE-2023-3084Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.1
• CVE-2023-30841Baremetal Operator (BMO) is a bare metal host provisioning i…5.5
• CVE-2023-30842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-30843Payload is a free and open source headless content managemen…6.5
• CVE-2023-30844Mutagen provides real-time file synchronization and flexible…8.8
• CVE-2023-30845ESPv2 is a service proxy that provides API management capabi…9.8
• CVE-2023-30846typed-rest-client is a library for Node Rest and Http Client…7.5