Executive brief
KubePi is a Kubernetes management panel that administrators use to oversee multiple clusters. In versions up to 2.0.0, certain API endpoints fail to verify that users have permission to access specific clusters, allowing a user with management rights over one cluster to read or modify data in other clusters they should not manage. This is fixed in version 2.0.1.
Technical details
The vulnerability is a cluster access control bypass in cluster-scoped APIs. The root cause is insufficient authorization validation at the API endpoint level—cluster-specific endpoints do not consistently verify that the authenticated requester is authorized for the particular cluster being accessed. An authenticated user with cluster management permissions can exploit this by making requests to cluster-scoped API endpoints for clusters outside their assigned scope, potentially reading or modifying cluster data without proper authorization. No CVSS score was published for this issue. The vulnerability was patched in version 2.0.1 (released 2026-08-03) via commit 8e6ceef that enforces cluster access checks across affected endpoints.
Affected products
- 1Panel KubePi up to and including 2.0.0
Timeline
- 2026-08-26: disclosed
- 2026-08-03: patched: Version 2.0.1 released with cluster access check enforcement