Executive brief
KubePi is a multi-cluster management dashboard for Kubernetes environments. In versions up to 1.6.15, the SSO and authentication configuration endpoints lack proper access controls, allowing unauthorized users to read, modify, or disable single sign-on settings. An attacker could alter authentication rules to gain unauthorized access, escalate privileges, or exploit the connectivity test function to probe internal networks.
Technical details
The vulnerability is an authorization bypass in KubePi's SSO configuration API endpoints. The SSO management endpoints were exposed on the same public routing boundary as login/callback endpoints without enforcing administrator-only access controls. The root cause is missing authorization checks on read, create, and update operations for global SSO configuration. An unauthenticated or low-privileged user can inspect or alter authentication settings (OIDC, SAML, SSO); additionally, the SSO connectivity-test function can be abused as a server-side request forgery (SSRF) primitive. The user list API also returns user objects with authentication-related fields inconsistently cleared, potentially exposing sensitive data. The fix, released in version 2.0.0, implements administrator-only authorization checks on SSO configuration endpoints.
Affected products
- 1Panel KubePi up to and including 1.6.15
Timeline
- 2026-08-26: disclosed
- 2026-07-03: patched: Version 2.0.0 released with authorization checks on SSO configuration endpoints