CVE-2026-65956: KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubePito a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Which deployments are affected?
KubePi versions up to and including 1.6.15 are affected. The issue is fixed in version 2.0.0.
Does exploitation require an administrator account?
No. The SSO, OIDC, and SAML management operations can be reached without administrator authorization, allowing an unauthorized or low-privileged user to inspect or modify global SSO configuration.
What impact can an attacker achieve through the exposed configuration APIs?
An attacker may alter authentication configuration in ways that, under certain conditions, lead to account takeover or privilege escalation. The SSO connectivity-test function can also be used as an SSRF primitive.
What sensitive information may be exposed through the user API?
The user list API returns user objects without consistently clearing authentication-related fields. This can expose authentication-related data to callers able to access that API.
What is the recommended remediation?
Upgrade KubePi to version 2.0.0, which fixes the issue.