CVE-2023-22480

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

• CWE-285
• CWE-863

• https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aafPatch, Third Party Advisory
• https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4Release Notes, Third Party Advisory
• https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8Patch, Third Party Advisory
• https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aafPatch, Third Party Advisory
• https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4Release Notes, Third Party Advisory
• https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8Patch, Third Party Advisory

Published

Jan 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22475Canarytokens is an open source tool which helps track activi…6.1
• CVE-2023-22476Mantis Bug Tracker (MantisBT) is an open source issue tracke…4.3
• CVE-2023-22477Mercurius is a GraphQL adapter for Fastify. Any users of Mer…7.5
• CVE-2023-22478KubePi is a modern Kubernetes panel. The API interfaces with…7.5
• CVE-2023-22479KubePi is a modern Kubernetes panel. A session fixation atta…6.5
• CVE-2023-2248Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-22481FreshRSS is a self-hosted RSS feed aggregator. When using th…5.5
• CVE-2023-22482Argo CD is a declarative, GitOps continuous delivery tool fo…8.8
• CVE-2023-22483cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-22484cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5
• CVE-2023-22485cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…5.3
• CVE-2023-22486cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…7.5