CVE-2026-69129

Received Received - Intake

KubePi Cluster Access Bypass via API Misconfiguration

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster access, allowing an authenticated user with cluster management permissions to operate on clusters outside the scope they were granted. Because the affected endpoints act on cluster-specific data without confirming that the requesting user is authorized for that particular cluster, a user assigned management rights over one cluster can, under certain role and cluster configurations, read or modify data in clusters they should not manage. This issue is fixed in version 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-69129

Affected Vendors & Products

Vendor	Product	Version / Range
kubepi	kubepi	to 2.0.0 (inc)
kubepi	kubepi	2.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

KubePi versions up to 2.0.0 have a flaw where cluster-scoped APIs do not properly validate per-cluster access. This allows an authenticated user with cluster management permissions to perform actions on clusters outside their granted scope. The issue arises because endpoints handling cluster-specific data fail to confirm the user's authorization for that particular cluster.

Detection Guidance

To detect this vulnerability, check if KubePi is running version 2.0.0 or earlier. Verify cluster-scoped API access controls and review user permissions for unauthorized cross-cluster operations. No specific commands are provided in the context.

Impact Analysis

If you manage a cluster using KubePi up to version 2.0.0, an attacker with management rights over one cluster could read or modify data in other clusters they should not have access to. This could lead to unauthorized data exposure or manipulation across multiple clusters.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized data exposure or modification may result in legal penalties or loss of trust.

Mitigation Strategies

Upgrade KubePi to version 2.0.1 or later to address the cluster-scoped API authorization issue.

Hi! I’m here to help you understand CVE-2026-69129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70