Description
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.
Published: 2026-08-26
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in KubePi versions up to 1.6.15 allows unauthenticated users to access SSO, OIDC, and SAML configuration endpoints. An attacker can read, create, or modify global SSO settings without administrator authorization, which can lead to administrative account takeover or privilege escalation. Additionally, an unprotected connectivity‑test function can be used as a server‑side request forgery primitive, and the user list API exposes authentication‑related fields to anyone querying it.

Affected Systems

Affected products are 1Panel‑dev KubePi running any version through 1.6.15. The issue was fixed in release 2.0.0. Administrators should verify the running version against the release notes linked in the advisory.

Risk and Exploitability

This flaw carries a CVSS score of 10 and has no EPSS estimate available, but it is not listed in the CISA KEV catalog. The exposed API endpoints are reachable over the public network boundary, meaning the attack vector is remote. An attacker with minimal or no privileges can exploit the configuration APIs directly, or abuse the connectivity‑test to perform SSRF. The high severity and remote nature of the vulnerability call for immediate remediation.

Generated by OpenCVE AI on August 27, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade KubePi to version 2.0.0 or later.
  • Restrict public exposure of the SSO configuration APIs using firewall or network policies so that only authenticated administrators can reach them.
  • Disable or protect the connectivity‑test endpoint to eliminate its use as an SSRF primitive.
  • Ensure that the user list API does not return sensitive authentication fields to unauthenticated callers.

Generated by OpenCVE AI on August 27, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared 1panel Dev
1panel Dev kubepi
Vendors & Products 1panel Dev
1panel Dev kubepi

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.
Title KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

1panel Dev Kubepi
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T22:40:55.741Z

Reserved: 2026-07-23T18:15:14.579Z

Link: CVE-2026-65956

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T23:17:15.550

Modified: 2026-08-26T23:17:15.550

Link: CVE-2026-65956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T00:30:14Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function