CVE-2023-22478

KubePi is vulnerable to missing authorization

State: Published
Severity: 7.3 High
Published: Jan 14, 2023
Updated: Mar 10, 2025
Reserved: Dec 29, 2022

Description

KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
KubePiKubeOperator	<= 1.6.3 Affected

References

https://github.com/KubeOperator/KubePi/security/advisories/GHSA-gqx8-hxmv-c4v4
https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6
https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.