KubePi - Authentication Bypass (CVE-2023-22463)

KubePi through version 1.6.2 suffers from an information disclosure vulnerability due to the use of hard-coded JWT signature keys, allowing attackers to forge authentication tokens and gain administrator access to any online project. This flaw, detailed in EUVD, could enable malicious actors to take over Kubernetes clusters managed by KubePi, leading to full compromise of enterprise environments. Upgrading to version 1.6.3 is required to remediate this critical security issue.

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.

CrowdSec network observations suggest that most exploitation of CVE-2023-22463 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. CrowdSec network telemetry also shows that exploitation of CVE-2023-22463 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the /kubepi/api/v1/users endpoint with a POST request to bypass authentication and create admin users using a hardcoded JWT, gaining unauthorized access to the KubePi management interface.