CVE-2026-65956

Received Received - Intake

Unauthenticated SSO Configuration Access in KubePi

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-65956

Affected Vendors & Products

Vendor	Product	Version / Range
kube-pi	kube-pi	to 1.6.15 (inc)
kube-pi	kube-pi	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

KubePi versions up to 1.6.15 expose SSO configuration API endpoints on the same public routing boundary as SSO login and callback endpoints. This allows unauthorized users to read, create, or update global SSO settings without administrator privileges. The issue can lead to account takeover or privilege escalation if exploited. Additionally, the SSO connectivity-test function can be abused for server-side request forgery, and the user list API may expose sensitive authentication-related fields.

Detection Guidance

Check if KubePi is running version 1.6.15 or earlier. Inspect network traffic for unauthorized access to SSO configuration endpoints like /api/sso, /api/oidc, or /api/saml. Look for unusual user list API responses containing authentication fields.

Impact Analysis

An unauthorized or low-privileged user could alter authentication settings, potentially taking over accounts or escalating privileges. The SSRF vulnerability could allow attackers to make unauthorized requests from the server. Sensitive user data might be exposed through the user list API.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unrestricted SSO configuration changes may also breach integrity and access control policies mandated by these regulations.

Mitigation Strategies

Upgrade KubePi to version 2.0.0 or later to address the vulnerability. Ensure only administrators can access SSO configuration API endpoints by reviewing and updating access controls.

Hi! I’m here to help you understand CVE-2026-65956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70