Is CVE-2023-22894 (Strapi Cleartext Storage of Sensitive Information) being exploited in the wild?

Yes. CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities catalogue on 8 October 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter.

What “exploited in the wild” means for this CVE

For a named CVE, “exploited in the wild” is not a vague suspicion. It means the vulnerability has crossed the line from theoretical weakness to confirmed active abuse, which is why CISA’s KEV catalogue matters so much. For this issue, the practical question is whether your Strapi deployment is exposed in a way that lets an attacker reach the admin panel and query stored sensitive details.

That distinction matters because a cleartext storage flaw is often low-friction for an attacker once admin access is obtained, and the damage is usually information exposure rather than code execution. If the admin interface is reachable, the immediate task is exposure confirmation, then containment, then review of what sensitive user information could have been disclosed through the query filter.

When a vulnerability is confirmed in KEV, treat it as a priority condition rather than a routine backlog item, and use the Zero-Day and Exploited Vulnerabilities Guide to structure KEV triage, emergency mitigation, and post-patch verification.

How to confirm exposure and limit immediate blast radius

Start with the deployed Strapi version and whether the admin panel is reachable from any network segment that should not have broad administrative access. If the application is internet-facing, or if the admin panel is shared across teams and environments, the exposure question is not just “is it installed?” but “who can realistically reach the control plane that reveals sensitive records?”

Next, validate whether the specific query filter behavior is present in your environment and whether sensitive fields are stored in a way that can be returned in cleartext. The most important check is not the presence of Strapi itself, but whether an authenticated admin path can disclose user details that should not be visible in that workflow. Where the answer is uncertain, inspect configuration, access logs, and any recent administrative queries or exports.

If patching or mitigation is delayed, narrow admin access immediately, remove unnecessary network reachability, and disable or restrict the parts of the admin workflow that expose sensitive records. For broader prioritisation, the Vulnerability Management Guide is a useful reference for asset scoping, KEV-driven prioritisation, and verification after remediation.

What to check after patching or mitigation

Because this issue involves sensitive information disclosure, remediation should not stop at “the version is fixed” or “the setting is changed.” Review whether any sensitive user data was already accessible through the admin panel, whether unusual exports or admin queries occurred before remediation, and whether the same data was copied into logs, tickets, backups, or downstream tooling.

If the exposed information includes secrets, session material, or other credentials, rotate them according to their actual use, not by default. In many cases, the right response is to revoke or replace only what could plausibly have been exposed, then confirm that the replacement material is not still retrievable through the same administrative path. If the incident review shows no evidence of access, retain the investigation record anyway, because KEV-listed exploitation often forces decisions before full certainty is available.

For a CVE that leaks sensitive fields, the right evidence is not just patch status but proof that the disclosure path is closed and that exposed data has been inventoried. The CISA Known Exploited Vulnerabilities Catalog should remain the authoritative source for exploitation status and required remediation timing, while the vendor advisory should provide the exact affected and fixed release details.

Risk and Threat Considerations

This kind of flaw is risky because it turns a trusted administrative function into an information disclosure path. Once an attacker reaches the admin panel, the weakness can expose data that was assumed to be internal only, which can accelerate follow-on account abuse, targeted phishing, or wider investigation into connected systems.

Failure mechanism: Sensitive values are stored or returned in cleartext through an administrative query path, so an attacker with admin-panel access can enumerate data that should have been protected by stronger data handling and access design.

Impact: The immediate consequence is confidentiality loss, but the downstream effect can include credential theft, user profiling, and faster lateral abuse if the disclosed information helps an attacker pivot into other systems or impersonate legitimate users.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Restricts exposed admin interfaces and unsafe application settings that enable disclosure.
Recommendation — Harden Strapi admin exposure and lock down insecure configuration paths that reveal sensitive data.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Limits who can reach admin functions that expose sensitive information.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports investigation of prior access to the sensitive query path.
Recommendation — Restrict administrative access paths to the minimum set of trusted operators. Review logs for evidence of administrative queries or unusual disclosure activity.
OWASP ASVS	V14 — Data Protection	Addresses protection of sensitive data that must not be disclosed through application logic.
	V8 — Authorization	Applies where admin-only paths can reveal data beyond intended authorization boundaries.
Recommendation — Verify sensitive fields are protected from unintended disclosure in application flows. Enforce authorization checks around any admin function that can reveal sensitive records.

Practitioner Guidance

What to prioritise: Treat admin-panel exposure and sensitive-field retrieval as the real risk driver, not just the Strapi deployment itself. If the panel is reachable beyond a tightly controlled administrative boundary, contain that first while remediation is being prepared.

What to verify: Confirm whether the vulnerable query path can return user details that are operationally sensitive, and whether those details were accessible before the fix. A clean patch is useful, but a credible response also needs evidence that the disclosure path was actually exercised or ruled out.

Decision rule: If you cannot patch immediately, reduce access to the admin interface and review for prior exposure in logs, exports, and downstream stores. If any sensitive material could have been retrieved, rotate or invalidate only the credentials and tokens that were plausibly exposed, then retest the workflow.

Practitioner takeaway: For KEV-listed disclosure flaws, the fastest safe response is to close the exposure path, then prove whether sensitive data actually left the system before deciding how much rotation or notification work is required.