CVE-2023-33190 - CVE House
Back to Database
Status published Critical CVE-2023-33190

Improperly configured permissions in Sealos

Vulnerability Description

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33190

Credits & Attribution

No credits recorded in the NVD database.

References

More from labring

View All →
CVE-2025-62612
FastGPT File Reading Node SSRF Vulnerability
Medium 6.9
CVE-2025-52552
FastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS
Medium 5.5
CVE-2025-49131
FastGPT Sandbox Vulnerable to Sandbox Bypass
Medium 6.3
CVE-2025-27600
FastGPT SSRF
Medium 6.9
CVE-2023-50253
laf logs leak
Critical 9.7

Affected Vendor

Affected Software

sealos
Vulnerable Versions:
< 4.2.1-rc4

Timeline

Official Publish: June 29th, 2023
Last Modified: November 6th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access