KubePi session fixation attack allows an attacker to hijack a legitimate user session. (CVE-2023-22479)

KubePi session fixation attack allows an attacker to hijack a legitimate user session. (CVE-2023-22479) | HOL Guard CVE

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/KubeOperator/kubepi (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/KubeOperator/kubepigo	>=0 <1.6.4	1.6.4

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/KubeOperator/kubepi.
Review the reported fix. Update github.com/KubeOperator/kubepi to 1.6.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jan 9, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Summary A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application. ### Affected Version <= v1.6.3 ### Patches The vulnerability has been fixed in [v1.6.4](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4). https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session. ### Workarounds It is recommended to upgrade the version to [v1.6.4](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4). ### For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/KubeOperator/KubePi/issues). This vulnerability is reported by [sachinh09](https://huntr.dev/users/sachinh09/) from [huntr.dev](https://huntr.dev/).

Quoted source text, attributed separately from HOL analysis.