Read the docs
TI-2023-18609 Aliases CVE-2023-36815GHSA-vpxf-q44g-w34w

Sealos billing system permission control defect

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labringsealosup to 4.2.0—No fix listedCNA
—github.com/labring/sealos (Go)up to 4.2.0—No fix listedGHSA-vpxf-q44g-w34w
  • sealos Vendorlabring Affected up to 4.2.0 Fixed in — No fix listed CNA
  • github.com/labring/sealos (Go) Vendor— Affected up to 4.2.0 Fixed in — No fix listed GHSA-vpxf-q44g-w34w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:sealos:sealos:*:*:*:*:*:*:*:*up to 4.2.0VulnerableSealos
  • cpe:2.3:o:sealos:sealos:*:*:*:*:*:*:*:* Versions up to 4.2.0 Vulnerable ·Sealos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36815
  2. 2026-10-03 Alias added: GHSA-vpxf-q44g-w34w

References

Advisory 2

Other 1

  • TI-2026-30610 FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox CVSS 3.1CRITICAL 9.8
  • TI-2026-48466 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization CVSS 4.0CRITICAL 9.3
  • TI-2026-44161 FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token') CVSS 4.0HIGH 8.8
  • TI-2026-44148 Incorrect authorization in labring FastGPT CVSS 3.1HIGH 7.7
  • TI-2026-39440 FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) CVSS 3.1HIGH 7.7
  • TI-2026-30646 FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion CVSS 4.0MEDIUM 6.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences