Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV
Only Strapi builds older than 4.8.0 (March 2023) are affected, but on those an unauthenticated attacker can take over the super admin, so any you find should be upgraded or taken offline today.
Must act: Anyone running Strapi v3 (from 3.2.1) or v4 below 4.8.0, especially internet-facing instances with publicly readable collections; v4.5.5 and older are also open to remote code execution through CVE-2023-22621.
Can relax: Teams on Strapi 5 or on v4 4.8.0 and later, which are not affected by this CVE, though v4 itself stopped receiving security updates in April 2026.
- Find every Strapi deployment and its version with npm ls @strapi/strapi, including containers and forgotten staging sites.
- Upgrade anything below 4.8.0; target Strapi 5, since v4 no longer gets security fixes.
- Until upgraded, put /admin and the API behind a VPN or allowlist, and review which collections the Public role can read.