CVE-2023-23939

CVE-2023-23939 is a high-severity vulnerability affecting Azure/setup-kubectl GitHub Action versions prior to v3. It allows for privilege escalation due to insecure permissions (world-writable) on the Kubectl binary during its temporary creation, enabling a local attacker to replace the binary. The CVSS score of 7.0 indicates a high impact on confidentiality, integrity, and availability, with high attack complexity requiring local access to the Actions runner. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in the KEV catalog.