ThreatPort
Login Register
CVE-2023-22463 CRITICAL

CVE-2023-22463 exposure check for Kubepi

Check whether public-facing assets expose Fit2cloud Kubepi signals related to CVE-2023-22463. Severity: CRITICAL.

Start free scan View $50 Pricing

From CVE Record to External Exposure

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.

Kubepi vulnerability should be triaged by matching the affected vendor and product to live, internet-facing assets rather than treating the CVE as an abstract feed item. ThreatPort focuses on the first question that budget-constrained IT leaders and CISOs ask: what can an outside observer find today, how severe is it, and what should be fixed first?

Known Exploitation Record

Known ransomware campaign use
Not recorded
EPSS exploitation probability
69.67% (99p)
CVSS base score
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Disclosed
2023-01-04
Weakness type
CWE-798

Source: CISA Known Exploited Vulnerabilities catalog and FIRST.org EPSS.

What ThreatPort Checks

Identify externally reachable services that appear related to Fit2cloud Kubepi.
Map detected technologies to CVE-2023-22463, severity context, and practical remediation priority.
Check TLS, DNS, headers, exposed panels, stale endpoints, and service fingerprints from a public attacker perspective.
Produce a concise scorecard first, then unlock deeper AI pentest evidence and PDF reporting when remediation planning begins.

The output is intentionally practical: ownership clues, risk context, remediation hints, and repeatable evidence that can be shared with technical teams or leadership. It is not positioned as magic compliance automation or a replacement for human security judgment.

Lean security teams rarely need another broad vulnerability list. They need to know whether an exposed endpoint, an expired certificate, a weak DNS setting, or a CVE-linked service is likely to affect the systems they actually run. ThreatPort scans from the outside in, ranks what it finds by real reachability rather than raw CVSS, and hands back evidence a team can act on the same day.

Route-Specific Evidence Profile

CVE-2023-22463 affects Fit2cloud Kubepi, a CWE-798 weakness. Disclosed 2023-01-04. This page exists to answer one question: is anything you own externally reachable and running it.

Assets This Page Should Care About

Public domains Subdomains Externally reachable web apps TLS endpoints DNS records

Signals Worth Prioritizing

Forgotten subdomains
Weak DNS or email controls
Outdated services
Risky headers

What Should Be Reviewed First in This Context?

For teams running Fit2cloud Kubepi, the first step is to validate internet-facing assets with business relevance instead of producing a generic vulnerability list.

Forgotten subdomains
Weak DNS or email controls
Outdated services
Risky headers

Action Checklist

  1. Confirm whether Kubepi is present on any public domain, subdomain, API, or admin surface.
  2. Prioritize CRITICAL exposure only when the affected service is reachable or business-critical.
  3. Patch, disable, isolate, or put compensating controls in front of the affected service.
  4. Re-scan after remediation to capture before-and-after evidence for technical teams or leadership.

Context-Aware Next Fixes

  1. Verify ownership of exposed assets
  2. Close unnecessary public services
  3. Remediate the highest-confidence exposed findings first, then re-scan to prove closure.

Useful evidence for this context usually maps to ISO 27001, SOC 2, vendor security reviews. ThreatPort keeps the language cautious: this is operational security evidence, not a legal certification or a guarantee that every auditor will accept a generated report without review.