Is CVE-2023-22463 actively exploited?

Yes. CVE-2023-22463 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2023-22463 be exploited remotely?

The attack vector of CVE-2023-22463 has not been classified yet.

What is the CVSS score of CVE-2023-22463?

CVE-2023-22463 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2023-22463

UNKNOWNCISA KEVIN THE WILD

CVE-2023-22463

Published: April 11, 2026

Official Description

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.

NVD Source

Risk Analysis

KubePi versions through 1.6.2 contain a critical vulnerability due to hard-coded JWT signature keys, allowing attackers to forge tokens and take over administrator accounts. This can lead to the compromise of entire Kubernetes clusters. The vulnerability is actively exploited, necessitating urgent patching.

This vulnerability is actively being exploited in the wild. An attacker can remotely forge JWT tokens to gain administrative access.

Recommended Action

Upgrade KubePi to version 1.6.3 or later. Ensure that the JWT key is specified in app.yml, or allow the system to generate a random key if left blank.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-22463 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2023-22463 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.