CVE-2023-33190
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of RBAC permissions allowed an attacker to obtain cluster control permissions, enabling control over the entire cluster and hundreds of pods and other resources.
Risk Assessment
Organizations may be exposed to full control over the cluster, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to version 4.2.1-rc4 to mitigate this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.