What is CVE-2023-33190?

CVE-2023-33190 is a critical-severity vulnerability in Labring Sealos, classified under Improper Authentication. CVSS score: 9.9/10. Published 2023-06-29.

How severe is CVE-2023-33190?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Auth bypass in Labring Sealos

CVE-2023-33190

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: Broken Authentication

EPSS: 0.007 (49.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Labring Sealos — versions < 4.2.1-rc4
Sealos_project Sealos — versions 4.2.1

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-33190?: CVE-2023-33190 is a critical-severity vulnerability in Labring Sealos, classified under Improper Authentication. CVSS score: 9.9/10. Published 2023-06-29.
How severe is CVE-2023-33190?: Critical severity. CVSS v3 base score is 9.9 out of 10.