# CVE-2026-69129: 1Panel KubePi cluster access control bypass in APIs

Source: https://junglewise.ai/threats/cve-2026-69129-1panel-kubepi-cluster-access-control-bypass-in-apis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69129 · Severity: info · CVSS 0 · Published 2026-08-26

KubePi is a Kubernetes management panel that administrators use to oversee multiple clusters. In versions up to 2.0.0, certain API endpoints fail to verify that users have permission to access specific clusters, allowing a user with management rights over one cluster to read or modify data in other clusters they should not manage. This is fixed in version 2.0.1.

Vendors: [1Panel](https://junglewise.ai/threats/vendors/1panel).

## Quick answers

**Is CVE-2026-69129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69129 being exploited in the wild.

**How severe is CVE-2026-69129?** Informational severity, with a CVSS score of 0, published 26 August 2026.

**Which products and versions are affected?** 1Panel KubePi up to and including 2.0.0.

**Is there a fix for CVE-2026-69129?** A patch was published on 2026-08-03: Version 2.0.1 released with cluster access check enforcement Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69129 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-69129?** Check whether you run 1Panel KubePi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cluster access control bypass in cluster-scoped APIs. The root cause is insufficient authorization validation at the API endpoint level—cluster-specific endpoints do not consistently verify that the authenticated requester is authorized for the particular cluster being accessed. An authenticated user with cluster management permissions can exploit this by making requests to cluster-scoped API endpoints for clusters outside their assigned scope, potentially reading or modifying cluster data without proper authorization. No CVSS score was published for this issue. The vulnerability was patched in version 2.0.1 (released 2026-08-03) via commit 8e6ceef that enforces cluster access checks across affected endpoints.

## Affected products

- 1Panel KubePi up to and including 2.0.0

## Timeline

- 2026-08-26: disclosed
- 2026-08-03: patched: Version 2.0.1 released with cluster access check enforcement

## References

- [https://github.com/1Panel-dev/KubePi/commit/8e6ceefc68f374225aba2e6bc1905bb4210e6045](https://github.com/1Panel-dev/KubePi/commit/8e6ceefc68f374225aba2e6bc1905bb4210e6045)
- [https://github.com/1Panel-dev/KubePi/releases/tag/v2.0.1](https://github.com/1Panel-dev/KubePi/releases/tag/v2.0.1)

## Related threats

- [KubePi SSO configuration authorization bypass](https://junglewise.ai/threats/cve-2026-65956-kubepi-sso-configuration-authorization-bypass)