CVE-2023-22480: KubeOperator is vulnerable to unauthorized access to system API
Vulnerability summary
CVE-2023-22480 is a critical (CVSS 9.8) Improper Authorization vulnerability in fit2cloud kubeoperator. EPSS estimates a 66.77% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities.
Severe, CVSS 7.3 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 67% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 14-01-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · GoEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
66.77%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 66.77% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Fit2cloud1 product
- kubeoperator< 3.16.4
Github.com/KubeOperator1 product
- KubeOperator≤ 3.16.3
Kubeoperator1 product
- kubeoperator≤ 3.16.3
3 vendors · 3 products
References
5 links- github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8X Refsource CONFIRMWEBPatchThird Party Advisory
- github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aafX Refsource MISCWEBPatchThird Party Advisory
- github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4X Refsource MISCWEBRelease NotesThird Party Advisory
