TI-2023-08712 Aliases CVE-2023-22463 GHSA-vjhf-8vqx-vqpq

KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

CRITICAL 86CWE-798Published 2023-01-04 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-798.

Summary

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.69667 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed KubePi (KubeOperator): 1.6.3github.com/KubeOperator/kubepi (Go): 1.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
1Panel-dev	KubePi	before 1.6.3	1.6.3	Patch available	CNA
—	github.com/KubeOperator/kubepi (Go)	before 1.6.3	1.6.3	Patch available	GHSA-vjhf-8vqx-vqpq

KubePi Vendor1Panel-dev Affected before 1.6.3 Fixed in 1.6.3 Patch available CNA
github.com/KubeOperator/kubepi (Go) Vendor— Affected before 1.6.3 Fixed in 1.6.3 Patch available GHSA-vjhf-8vqx-vqpq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:fit2cloud:kubepi::::::::	before 1.6.3	Vulnerable	1Panel-dev

cpe:2.3:a:fit2cloud:kubepi:*:*:*:*:*:*:*:* Versions before 1.6.3 Vulnerable ·1Panel-dev

Remediation

Fix · CNA KubePi (KubeOperator) Fixed in 1.6.3
Fix · GHSA-vjhf-8vqx-vqpq github.com/KubeOperator/kubepi (Go) Fixed in 1.6.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-22463
2026-10-03 Alias added: GHSA-vjhf-8vqx-vqpq

References

Exploit 1

https://github.com/KubeOperator/KubePi/security/advisories/GHSA-vjhf-8vqx-vqpq

Patch 1

https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b

Advisory 3

Other 1

https://github.com/KubeOperator/KubePi

TI-2023-19350 Privilege Escalation in kubepi CVSS 3.1CRITICAL 9.1
TI-2023-19349 Leak password hash of any user CVSS 3.1HIGH 7.5
TI-2023-08727 KubePi is vulnerable to missing authorization CVSS 3.1HIGH 7.5
TI-2023-08728 KubePi vulnerable to session fixation attack CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences