{"id":"CVE-2023-37916","aliases":["GHSA-87f6-8gr7-pc6h","GO-2023-1957"],"title":"KubePi may leak password hash of any user","summary":"KubePi may leak password hash of any user","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"KubeOperator","product":"github.com/KubeOperator/kubepi","ecosystem":"go","affected":["github.com/KubeOperator/kubepi < 1.6.5"],"patched":["github.com/KubeOperator/kubepi 1.6.5"],"published":"2023-07-21","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:42.593391229Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-87f6-8gr7-pc6h","references":[{"url":"https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-87f6-8gr7-pc6h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37916"},{"url":"https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview"},{"url":"https://github.com/1Panel-dev/KubePi"},{"url":"https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5"}],"tags":["osv","go"],"epss":0.00814,"epssPercentile":0.55561,"ingestedAt":"2026-09-12T03:13:01.766Z","slug":"CVE-2023-37916","body":"## Overview\n\n### Summary\nhttp://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack\n\n\n### PoC\nhttps://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview\n\n### Impact\n- Leaking confidential information.\n- Can lead to password cracking attacks\n\n\n## Affected packages\n\n- `github.com/KubeOperator/kubepi < 1.6.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/KubeOperator/kubepi 1.6.5`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}