VYPR
← All advisories
Critical severityNVD Advisory· Published Jan 4, 2023· Updated Mar 10, 2025

KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

CVE-2023-22463

Description

KubePi ≤1.6.2 uses hard-coded JWT signing keys, enabling attackers to forge admin tokens and compromise Kubernetes clusters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

KubePi ≤1.6.2 uses hard-coded JWT signing keys, enabling attackers to forge admin tokens and compromise Kubernetes clusters.

Vulnerability

Overview

CVE-2023-22463 affects KubePi, a Kubernetes management panel, through version 1.6.2. The root cause is a hard-coded JWT signing key (JwtSigKey) defined in internal/api/v1/session/session.go [4]. This key, "signature_hmac_secret_shared_key", is identical across all deployments, meaning every KubePi instance uses the same secret for signing JSON Web Tokens [1][2].

Exploitation

An attacker with network access to a KubePi instance can forge arbitrary JWT tokens using the publicly known hard-coded key. No authentication is required to exploit this; the attacker simply crafts a token with administrator privileges and presents it to the KubePi API [1]. The vulnerability is trivially exploitable because the key is static and shared globally.

Impact

Successful exploitation allows an attacker to impersonate any user, including the built-in administrator account. From there, the attacker can fully control the KubePi panel and, by extension, the managed Kubernetes cluster(s) [1]. This could lead to data exfiltration, deployment of malicious workloads, or complete cluster compromise.

Mitigation

The vulnerability is fixed in KubePi version 1.6.3 [3]. The fix removes the hard-coded key and instead reads the JWT signing key from the configuration file (app.yml). If the key field is left empty, a random key is generated at startup [2]. There are no workarounds; upgrading to 1.6.3 or later is required.

References
  1. NVD - CVE-2023-22463
  2. fix: 解决 jwt 硬编码导致的 k8s 集群接管漏洞 · 1Panel-dev/KubePi@3be58b8
  3. Release v1.6.3 · 1Panel-dev/KubePi
  4. KubePi/internal/api/v1/session/session.go at da784f5532ea2495b92708cacb32703bff3a45a3 · 1Panel-dev/KubePi

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/KubeOperator/kubepiGo
< 1.6.31.6.3

Affected products

2

Patches

1
3be58b8df5bc

fix: 解决 jwt 硬编码导致的 k8s 集群接管漏洞

https://github.com/KubeOperator/KubePizhengkunwang223Jan 4, 2023via ghsa
commit
6 files changed · +36 −10
  • conf/app.yml+3 −1 modified
    @@ -12,4 +12,6 @@ spec:
   db:
     path: /var/lib/kubepi/db/kubepi.db
   session:
-    expires: 24
\ No newline at end of file
+    expires: 24
+  jwt:
+    key:
\ No newline at end of file
  • internal/api/v1/session/session.go+1 −2 modified
    @@ -32,7 +32,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-var JwtSigKey = []byte("signature_hmac_secret_shared_key")
 var jwtMaxAge = 10 * time.Minute
 
 type Handler struct {
@@ -51,7 +50,7 @@ func NewHandler() *Handler {
 		roleService:        role.NewService(),
 		rolebindingService: rolebinding.NewService(),
 		ldapService:        ldap.NewService(),
-		jwtSigner:          jwt.NewSigner(jwt.HS256, JwtSigKey, jwtMaxAge),
+		jwtSigner:          jwt.NewSigner(jwt.HS256, server.Config().Spec.Jwt.Key, jwtMaxAge),
 	}
 }
  • internal/api/v1/v1.go+1 −2 modified
    @@ -401,8 +401,7 @@ func resourceNameInvalidHandler() iris.Handler {
 }
 
 func WarpedJwtHandler() iris.Handler {
-
-	verifier := jwt.NewVerifier(jwt.HS256, session.JwtSigKey)
+	verifier := jwt.NewVerifier(jwt.HS256, server.Config().Spec.Jwt.Key)
 	verifier.WithDefaultBlocklist()
 	verifyMiddleware := verifier.Verify(func() interface{} {
 		return new(session.UserProfile)
  • internal/config/config.go+25 −5 modified
    @@ -1,12 +1,15 @@
 package config
 
 import (
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
 	"github.com/KubeOperator/kubepi/internal/model/v1/config"
 	"github.com/KubeOperator/kubepi/pkg/file"
 	"github.com/coreos/etcd/pkg/fileutil"
 	"github.com/spf13/viper"
+	"math/big"
+	"strconv"
 )
 
 const configNotFoundSkipErr = "config file not found in %s, skip"
@@ -17,7 +20,7 @@ var configFilePaths = []string{
 	"/etc/kubepi",
 }
 
-func ReadConfig(c *config.Config, path ...string)  error {
+func ReadConfig(c *config.Config, path ...string) error {
 	v := viper.New()
 	v.SetConfigName("app")
 	v.SetConfigType("yaml")
@@ -41,19 +44,36 @@ func ReadConfig(c *config.Config, path ...string)  error {
 		if err := v.MergeInConfig(); err != nil {
 			fmt.Println(fmt.Sprintf(configMergeErr, configFilePaths))
 		}
+
 	}
 
 	var configMap map[string]interface{}
 	if err := v.Unmarshal(&configMap); err != nil {
-		return  err
+		return err
 	}
 	str, err := json.Marshal(&configMap)
 	if err != nil {
-		return  err
+		return err
 	}
 	if err := json.Unmarshal(str, &c); err != nil {
-		return  nil
+		return nil
+	}
+	if c.Spec.Jwt.Key == "" {
+		v.Set("spec.jwt.key", generate(32))
+		if err := v.WriteConfig(); err != nil {
+			return err
+		}
 	}
-	return  nil
+	return nil
 }
 
+func generate(length int) string {
+	const base = 36
+	size := big.NewInt(base)
+	n := make([]byte, length)
+	for i := range n {
+		c, _ := rand.Int(rand.Reader, size)
+		n[i] = strconv.FormatInt(c.Int64(), base)[0]
+	}
+	return string(n)
+}
  • internal/model/v1/config/config.go+5 −0 modified
    @@ -12,6 +12,7 @@ type Spec struct {
 	DB      DBConfig      `json:"db"`
 	Session SessionConfig `json:"session"`
 	Logger  LoggerConfig  `json:"logger"`
+	Jwt     JwtConfig     `json:"jwt"`
 	AppId   string        `json:"appId"`
 }
 
@@ -42,3 +43,7 @@ type DBConfig struct {
 type SessionConfig struct {
 	Expires int `json:"expires"`
 }
+
+type JwtConfig struct {
+	Key string `json:"key"`
+}
  • internal/server/server.go+1 −0 modified
    @@ -340,6 +340,7 @@ func getDefaultConfig() *v1Config.Config {
 				Expires: 72,
 			},
 			Logger: v1Config.LoggerConfig{Level: "debug"},
+			Jwt:    v1Config.JwtConfig{},
 		},
 	}
 }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.