CVE-2022-23652

    Dashboard / Vulnerabilities / CVE-2022-23652

    CVE-2022-23652

    Published: 22 Feb 2022Last Modified: 12 Aug 2026

    Summary: Privilege escalation using hop-by-hop Connection header

    Details: capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23652.json, https://github.com/clastix/capsule-proxy/security/advisories/GHSA-9cwv-cppx-mqjm, https://nvd.nist.gov/vuln/detail/CVE-2022-23652, https://github.com/clastix/capsule-proxy/issues/188, https://github.com/clastix/capsule-proxy/commit/efe91f68ebf8a9e3d21491dc57da7b8a746415d8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d85232c51624817909af86825fbc70c32e27be0e

    Affected versions

    v0.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23652 | CVE-DB