# CVE-2023-22463: KubePi - Authentication Bypass

> Live exploitation tracking for CVE-2023-22463 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-22463

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** KubeOperator KubePi
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** enterprise_software

## Description

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.

## CrowdSec analysis

KubePi through version 1.6.2 suffers from an information disclosure vulnerability due to the use of hard-coded JWT signature keys, allowing attackers to forge authentication tokens and gain administrator access to any online project. This flaw, detailed in [EUVD](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-22463), could enable malicious actors to take over Kubernetes clusters managed by KubePi, leading to full compromise of enterprise environments. Upgrading to version 1.6.3 is required to remediate this critical security issue.

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.

CrowdSec network observations suggest that most exploitation of CVE-2023-22463 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec network telemetry also shows that exploitation of CVE-2023-22463 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/kubepi/api/v1/users` endpoint with a POST request to bypass authentication and create admin users using a hardcoded JWT, gaining unauthorized access to the KubePi management interface.

## Timeline

- 2023-01-04: CVE Published. CVE-2023-22463 is published to NVD.
- 2025-06-12: Rule Released. CrowdSec releases a rule to detect CVE-2023-22463 exploitation attempts against the CrowdSec Network.
- 2025-06-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-22463 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22463.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-22463) follows observed exploitation activity for CVE-2023-22463. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.