1Panel-dev KubePi up to 1.6.15 SSO Configuration privileges management

Summaryinfo

A vulnerability, which was classified as critical, has been found in 1Panel-dev KubePi up to 1.6.15. Affected by this vulnerability is an unknown functionality of the component SSO Configuration. Performing a manipulation results in privileges management. This vulnerability was named CVE-2026-65956. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in 1Panel-dev KubePi up to 1.6.15. It has been classified as critical. This affects an unknown functionality of the component SSO Configuration. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-65956 since 07/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2.0.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• 1Panel-dev

Name

• KubePi

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15

Website

• Product: https://github.com/1Panel-dev/KubePi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion