9.8

CVE-2023-22463: KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

Modified
AliasesGHSA-vjhf-8vqx-vqpqGO-2023-1283
Published 04-01-2023Last modified 10-03-2025

Vulnerability summary

CVE-2023-22463 is a critical (CVSS 9.8) Use of Hard-coded Credentials vulnerability in fit2cloud kubepi. EPSS estimates a 69.67% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.0 (CVE.org)
EPSS score
69.67%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Timeline

  1. 04-01-2023
    PublishedVulnerability first disclosed.
  2. 10-03-2025
    Last modifiedVulnerability information updated.

Description

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

69.67%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 69.67% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Kubepi

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Fit2cloud1 product
Github.com/KubeOperator1 product
  • kubepi< 1.6.3
Kubeoperator1 product

3 vendors · 3 products

References

6 links