Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-65956: KubePi lets anyone change login settings and hijack accounts
CVE-2026-65956 · published 8 days ago
Summary
The KubePi dashboard (versions up to 1.6.15) lets users who are not administrators modify the single‑sign‑on configuration and view user details. This can let a malicious person take over an admin account or make the system send requests to internal services. Upgrade to KubePi 2.0.0 or later to close the problem and restrict these settings to admins only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| 1panel-dev | kubepi | < 2.0.0 |
Original advisory text
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login a...
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.
References
- https://github.com/1Panel-dev/KubePi/commit/b62b41f82659e36102fccd215b13264b2035...
- https://github.com/1Panel-dev/KubePi/releases/tag/v2.0.0
- https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-wjrh-4j52-c664
- https://nvd.nist.gov/vuln/detail/CVE-2026-65956 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65956... Vendor Advisory
Severity
10.0
Critical
CVSS 4.0: 10.0 (NVD)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published26 Aug 2026
Updated2 Sep 2026
First seen26 Aug 2026
Monitor software like this
Free during beta