# CVE-2026-65956: KubePi SSO configuration authorization bypass

Source: https://junglewise.ai/threats/cve-2026-65956-kubepi-sso-configuration-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-65956 · Severity: info · CVSS 7.5 · Published 2026-08-26

KubePi is a multi-cluster management dashboard for Kubernetes environments. In versions up to 1.6.15, the SSO and authentication configuration endpoints lack proper access controls, allowing unauthorized users to read, modify, or disable single sign-on settings. An attacker could alter authentication rules to gain unauthorized access, escalate privileges, or exploit the connectivity test function to probe internal networks.

Vendors: [1Panel](https://junglewise.ai/threats/vendors/1panel).

## Quick answers

**Is CVE-2026-65956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65956 being exploited in the wild.

**How severe is CVE-2026-65956?** Informational severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** 1Panel KubePi up to and including 1.6.15.

**Is there a fix for CVE-2026-65956?** A patch was published on 2026-07-03: Version 2.0.0 released with authorization checks on SSO configuration endpoints Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65956 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-65956?** Check whether you run 1Panel KubePi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in KubePi's SSO configuration API endpoints. The SSO management endpoints were exposed on the same public routing boundary as login/callback endpoints without enforcing administrator-only access controls. The root cause is missing authorization checks on read, create, and update operations for global SSO configuration. An unauthenticated or low-privileged user can inspect or alter authentication settings (OIDC, SAML, SSO); additionally, the SSO connectivity-test function can be abused as a server-side request forgery (SSRF) primitive. The user list API also returns user objects with authentication-related fields inconsistently cleared, potentially exposing sensitive data. The fix, released in version 2.0.0, implements administrator-only authorization checks on SSO configuration endpoints.

## Affected products

- 1Panel KubePi up to and including 1.6.15

## Timeline

- 2026-08-26: disclosed
- 2026-07-03: patched: Version 2.0.0 released with authorization checks on SSO configuration endpoints

## References

- [https://github.com/1Panel-dev/KubePi/commit/b62b41f82659e36102fccd215b13264b2035f1ea](https://github.com/1Panel-dev/KubePi/commit/b62b41f82659e36102fccd215b13264b2035f1ea)
- [https://github.com/1Panel-dev/KubePi/releases/tag/v2.0.0](https://github.com/1Panel-dev/KubePi/releases/tag/v2.0.0)

## Related threats

- [1Panel KubePi cluster access control bypass in APIs](https://junglewise.ai/threats/cve-2026-69129-1panel-kubepi-cluster-access-control-bypass-in-apis)