CVE-2026-65956: KubePi SSO Authentication Bypass Vulnerability

CVE-2026-65956 Overview

CVE-2026-65956 is a missing authorization vulnerability [CWE-306] in KubePi, a Kubernetes multi-cluster management panel developed by 1Panel. Versions up to and including 1.6.15 expose SSO configuration API endpoints on the same public routing boundary as the SSO login and callback endpoints. Unauthenticated or low-privileged users can read, create, and modify Single Sign-On (SSO), OpenID Connect (OIDC), and Security Assertion Markup Language (SAML) settings without administrator authorization. The flaw enables account takeover, privilege escalation, and Server-Side Request Forgery (SSRF) through the SSO connectivity-test function. The user list API also returns user objects without consistently clearing authentication-related fields. The issue is fixed in version 2.0.0.

Critical Impact
Unauthenticated attackers can alter authentication configuration in KubePi to take over administrator accounts and gain control of managed Kubernetes clusters.

Affected Products

KubePi versions up to and including 1.6.15
1Panel-dev KubePi Kubernetes multi-cluster management panel
Deployments exposing the KubePi API to untrusted networks

Discovery Timeline

2026-08-26 - CVE-2026-65956 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-65956

Vulnerability Analysis

KubePi exposes several SSO management endpoints under a routing group that also serves the public SSO login and callback endpoints. Because the group is treated as publicly reachable, the framework does not enforce administrator authorization on the management handlers. Any network-reachable client can call the SSO read, create, and update handlers.

An attacker can rewrite the SSO configuration to point authentication at an attacker-controlled OIDC or SAML identity provider. Subsequent logins can then be validated against attacker-issued tokens, resulting in account takeover of the built-in administrator. The SSO connectivity-test endpoint accepts a target URL and issues outbound requests from the KubePi server, providing an SSRF primitive against internal services, cluster APIs, and cloud metadata endpoints.

A secondary defect in the user list API returns full user objects without clearing the Authenticate fields, leaking credential material and token data to callers.

Root Cause

The root cause is missing authorization on SSO management handlers in internal/api/v1/sso/sso.go. The handlers relied on router-level grouping for access control rather than checking the authenticated principal's IsAdministrator flag. The user handler in internal/api/v1/user/user.go additionally serialized the Authenticate structure into API responses.

Attack Vector

Exploitation requires only network access to the KubePi API. An attacker sends an HTTP request to the SSO configuration endpoint to overwrite the OIDC or SAML provider, then completes an SSO login flow to obtain administrator privileges. The connectivity-test endpoint can be used independently to probe internal networks.

// Security patch: internal/api/v1/sso/sso.go
// Adds administrator check to SSO management handlers.

func isAdministrator(ctx *context.Context) bool {
    profile, ok := ctx.Values().Get("profile").(v1Session.UserProfile)
    if !ok || !profile.IsAdministrator {
        ctx.StatusCode(iris.StatusForbidden)
        ctx.Values().Set("message", "only administrator can manage SSO")
        return false
    }
    return true
}

func (h *Handler) AddSso() iris.Handler {
    return func(ctx *context.Context) {
        if !isAdministrator(ctx) {
            return
        }
        var req v1Sso.Sso
        if err := ctx.ReadJSON(&req); err != nil {
            ctx.StatusCode(iris.StatusBadRequest)
            // ...
        }
    }
}

// Source: https://github.com/1Panel-dev/KubePi/commit/b62b41f82659e36102fccd215b13264b2035f1ea

// Security patch: internal/api/v1/user/user.go
// Clears authentication fields before returning user objects.

for i := range us {
    us[i].Authenticate = v1User.Authenticate{}
}
ctx.Values().Set("data", us)

// Source: https://github.com/1Panel-dev/KubePi/commit/b62b41f82659e36102fccd215b13264b2035f1ea

Detection Methods for CVE-2026-65956

Indicators of Compromise

Unexpected modifications to the KubePi SSO, OIDC, or SAML configuration, especially provider URLs or client identifiers pointing to unfamiliar domains.
HTTP requests to KubePi SSO management endpoints (for example /api/v1/sso) from clients that never authenticated as an administrator.
Outbound requests originating from the KubePi server to internal IP ranges, cloud metadata addresses (169.254.169.254), or arbitrary external hosts triggered by the SSO connectivity-test function.
Administrator logins from new source addresses immediately after SSO configuration changes.

Detection Strategies

Review KubePi application and reverse-proxy access logs for POST or PUT requests to SSO configuration paths without a preceding authenticated administrator session.
Correlate SSO configuration change events with subsequent successful logins to detect account takeover chains.
Alert on any successful call to the SSO connectivity-test endpoint with target hosts on RFC1918 ranges or cloud metadata endpoints.

Monitoring Recommendations

Ingest KubePi API logs and Kubernetes audit logs into a centralized analytics platform and retain them for post-incident review.
Monitor egress traffic from KubePi hosts for anomalous destinations that indicate SSRF probing.
Track changes to the KubePi database sso table or configuration store for unexpected writes.

How to Mitigate CVE-2026-65956

Immediate Actions Required

Upgrade KubePi to version 2.0.0, which enforces administrator authorization on SSO management handlers and strips authentication fields from user list responses.
Restrict network access to the KubePi API using firewall rules, VPN, or a reverse proxy that requires authentication before requests reach the application.
Rotate KubePi administrator credentials and any OIDC or SAML client secrets that may have been exposed through the user list or SSO configuration endpoints.
Audit existing SSO, OIDC, and SAML configurations for unauthorized provider changes and revert any unrecognized entries.

Patch Information

The fix is available in KubePi Release v2.0.0. The patch commit b62b41f8 adds an isAdministrator check to each SSO management handler and clears the Authenticate field in user list responses. Additional detail is available in GitHub Security Advisory GHSA-wjrh-4j52-c664.

Workarounds

Place KubePi behind a reverse proxy that enforces administrator authentication before forwarding requests to SSO configuration paths.
Block external access to KubePi entirely and permit only administrative jump hosts to reach the management interface until the upgrade is completed.
Disable SSO integration if it is not required, and remove any existing SSO provider entries to eliminate the account takeover path.

bash

# Example: restrict KubePi API access with an ingress allowlist
# Deny external access to SSO management endpoints and only allow admin CIDR.
location ~ ^/api/v1/sso {
    allow 10.10.0.0/24;   # administrator jump network
    deny all;
    proxy_pass http://kubepi_upstream;
}