CyberSecBulletin

KubeOperator vulnerabilities

We track 3 vulnerabilities in KubeOperator products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on January 14, 2023.

3vulnerabilities
2critical
1high
0exploited
9.0average CVSS score

Latest KubeOperator vulnerabilities

  • 9.8 Critical severity

    KubeOperator: Incorrect Authorization

    CVE-2023-22480KubeOperatorEPSS 66.8%

    KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive informatio

  • 7.5 High severity

    KubePi: Missing Authorization

    CVE-2023-22478KubeOperatorEPSS 3.96%

    KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.

  • 9.8 Critical severity

    KubePi: Use of Hard-coded Credentials

    CVE-2023-22463KubeOperatorEPSS 69.7%

    KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator acco