Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV

What to do

1. Find every Strapi deployment and its version with npm ls @strapi/strapi, including containers and forgotten staging sites.
2. Upgrade anything below 4.8.0; target Strapi 5, since v4 no longer gets security fixes.
3. Until upgraded, put /admin and the API behind a VPN or allowlist, and review which collections the Public role can read.
4. Run Strapi's log grep for filters on email, password and reset-token fields; on any hits, start incident response.
5. If exposure is possible, reset admin and API user passwords, rotate ADMIN_JWT_SECRET, JWT_SECRET, API_TOKEN_SALT, APP_KEYS and API tokens, and review admin accounts and email templates.

How to check if you are affected or compromised

• Search request logs with Strapi's pattern: grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)'; repeated hits on password or reset-token fields mean hashes and tokens were likely leaked.
• Look for PUT requests to /users-permissions/email-templates, then inspect email templates for code inside <% %> blocks beyond the standard variables.
• Check for unexpected super admin password resets, new admin users, new API tokens, and processes spawned by the Node.js server.

What happened#

CVE-2023-22894 lets an attacker filter Strapi queries on private fields, such as a user's email, password hash and password reset token, and work out each value from how the results change. Strapi fixed it in v4.8.0 on March 15, 2023, holding back the details. It published the full disclosure on April 17, 2023, the same day the researcher GhostCcamm published a write-up. The researcher summed up the root cause: "Strapi just removes private fields from query results and does not remove private fields from the actual query." An attacker can then recover a hash or token one character at a time with $startsWith filters.

The CVE record and CISA describe an attacker "with access to the admin panel." Strapi's own timeline goes further. On January 21, 2023, the researcher found a way to exploit the bug "as an unauthenticated user on all Strapi servers." Strapi automatically links entries an admin creates or updates to that admin, so any publicly readable collection containing admin-authored entries becomes a path to the admin's record. The chain works like this: leak the super admin's email, trigger a password reset, leak the reset token, and set a new password. On Strapi 4.5.5 and older, the attacker can then abuse CVE-2023-22621, a server-side template injection in the users-permissions email templates fixed in 4.5.6 (January 11, 2023), to run code on the server.

The reason for KEV now: on October 8, 2026, the joint advisory AA26-281A, from the FBI, CISA, NSA and six partner countries, listed CVE-2023-22894 among eight CVEs "successfully exploited" by China-linked actors enabled by Integrity Technology Group. CISA added it to the KEV catalog the same day, with an October 11 deadline. The advisory says nothing about when, how or against whom Strapi was exploited, and we found no other public 2026 reporting. CVE-2023-22621 is not in KEV as of Oct 21, 2026.

Who is affected#

Strapi, NVD and GHSA-jjqf-j4w7-92w8 list versions 3.2.1 up to but not including 4.8.0. GhostCcamm's write-up says 4.7.1 and older, and AA26-281A says up to 4.5.5. The full remote code execution chain needs a version below 4.5.6 (GHSA-2h87-4q2w-v4hf). Strapi v3 reached end-of-life at the end of 2022 and never got a fix. According to Strapi's security policy, v4 stopped receiving security updates in April 2026, leaving 5.x as the only supported line. The instances still at risk are typically marketing sites, app backends and internal content tools built in 2021 or 2022 and never upgraded.

Do you really need to act?#

If you don't run Strapi, or you run Strapi 5, no. If you run v4 at 4.8.0 or later, this CVE does not affect you, but you are on an end-of-life line, so plan the move to v5. If you run anything older than 4.8.0 and it is reachable from the internet, treat it as urgent and ignore the "admin access" wording. NVD scores it 4.9 and CISA's ADP 7.2, both assuming high privileges. Strapi's own vector, AV:N/AC:L/PR:N/UI:N with high impact on confidentiality, integrity and availability, reflects the unauthenticated takeover, and Strapi rated the bug Critical.

What to do now#

1. Find versions: run npm ls @strapi/strapi in each project, and check running containers and old staging hosts.
2. Upgrade anything below 4.8.0, aiming for Strapi 5. A v4 upgrade to 4.8.0 or later closes both CVEs, but v4 is still unsupported.
3. Until then, restrict /admin and the API to a VPN or IP allowlist, and review the Public role's permissions under Settings > Users & Permissions.
4. If the log check below finds anything, reset every admin and API user password, rotate ADMIN_JWT_SECRET, JWT_SECRET, API_TOKEN_SALT, APP_KEYS and API tokens, and audit admin users.
5. On 4.5.5 or older with signs of compromise, rebuild the server rather than upgrading in place.

How to tell if you were hit#

Strapi says exploitation is "easily detectable" because the payload sits in GET parameters. Its suggested command is grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE. Many matching requests on password or reset-token fields mean hashes and tokens have probably leaked, and Strapi says to start incident response immediately. For CVE-2023-22621, look for PUT requests to /users-permissions/email-templates. Then check the reset-password and confirmation templates for code inside <% %> blocks other than the standard URL, TOKEN or CODE variables. Also watch for unexplained admin password resets and new admin users or API tokens.

Timeline#

• Jan 3, 2023 — CVE-2023-22894 is reported to Strapi as an admin-only, Medium-severity issue.
• Jan 11, 2023 — Strapi 4.5.6 fixes CVE-2023-22621.
• Jan 21, 2023 — The researcher demonstrates unauthenticated exploitation and an unauthenticated RCE chain.
• Mar 15, 2023 — Strapi 4.8.0 fixes CVE-2023-22894.
• Apr 17, 2023 — Full public disclosure. The CVE is published April 19.
• Oct 8, 2026 — AA26-281A names it as exploited, and CISA adds it to KEV (coverage).
• Oct 11, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2023-22894 · KEV 2026-10-08 · Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.
• CVE-2023-22621 · Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Strapi — Security Disclosure of Vulnerabilities: CVE-2023-22893, CVE-2023-22621, and CVE-2023-22894 strapi.io
2. CVE record — CVE-2023-22894 cve.org
3. NVD — CVE-2023-22894 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2023-22894 cisa.gov
5. Strapi / GitHub — Release v4.8.0 github.com
6. Strapi / GitHub — Security Policy (supported versions) github.com
7. GitHub Advisory Database — GHSA-jjqf-j4w7-92w8 (CVE-2023-22894) github.com
8. GitHub Advisory Database — GHSA-2h87-4q2w-v4hf (CVE-2023-22621) github.com
9. GhostCcamm — Multiple Critical Vulnerabilities in Strapi Versions <=4.7.1 ghostccamm.com
10. CISA, FBI, NSA et al. — AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data cisa.gov

Coverage and analysis

1. The Hacker News — Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies thehackernews.com