CVE-2023-22463
CriticalExploitedPublic exploitKubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys
Published Jan 6, 2023 · Updated Sep 10, 2026 · Also known as GHSA-vjhf-8vqx-vqpq, GO-2023-1283
Key Facts
Patch immediately- CVE-2023-22463 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting KubePi (Fit2cloud), github.com/KubeOperator/kubepi (go).
- It is exploited in the wild, listed in Industry KEV feed since Jun 23, 2025. Public exploit code is available.
- EPSS estimates a 70% probability of exploitation in the next 30 days.
- Fixed versions are available, including KubePi 1.6.3, github.com/KubeOperator/kubepi 1.6.3.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
70%
Higher than 99.3% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-22463 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. session.go, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Jun 23, 2025 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| KubePiFit2cloud | >= < 1.6.3 | 1.6.3 |
| github.com/KubeOperator/kubepigo | See advisory | 1.6.3 |
Patched Releases
KubePi
1.6.3
github.com/KubeOperator/kubepi
1.6.3
Timeline
Publicly disclosed
Jan 6, 2023
Added to Industry KEV feed
Jun 23, 2025
Last updated
Sep 10, 2026
Weakness Type
- CWE-798 Use of Hard-coded Credentials
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22463.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-22463
- exploitVulnCheck exploitation report
- articlehttps://github.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35
FAQ
Common Questions.
KubePi is a k8s panel.
Affected: KubePi (Fit2cloud) versions >= < 1.6.3; github.com/KubeOperator/kubepi (go). The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Jun 23, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including KubePi 1.6.3, github.com/KubeOperator/kubepi 1.6.3.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2023-22463 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo