CVE-2023-30840

CVE-2023-30840 is a high-severity vulnerability affecting Fluid, an open-source Kubernetes-native distributed dataset orchestrator, in versions 0.7.0 through 0.8.5. A malicious user with control of a Kubernetes node running the fluid csi pod can leverage its service account to modify node specifications, potentially leading to privilege escalation and full cluster compromise. While requiring a compromised node and external methods to identify vulnerable nodes, successful exploitation could allow attackers to access all secrets or execute pods on other nodes. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.