CVE-2023-33190
Critical
Description
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityCritical
CVSS9.9
Exploit probability—
ProductSealos
PublishedJun 29, 2023
First seenJun 29, 2023
Weakness typeCWE-287Improper authentication
How to fix
Update
- sealos_project sealos4.2.1 or later
- github.com/labring/sealos4.2.1-rc4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sealos_project sealos | v < 4.2.1, 4.2.1 | 4.2.1 |
| github.com/labring/sealosGo | v < 4.2.1-rc4 | 4.2.1-rc4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.