CVE-2026-65956: CWE-306: Missing Authentication for Critical Function in 1Panel-dev KubePi

KubePi, a Kubernetes multi-cluster management panel, suffers from a CWE-306 missing authentication vulnerability in versions up to 1.6.15. The SSO configuration API endpoints are exposed on the same public routing boundary as SSO login and callback endpoints without proper administrator authorization checks. This allows unauthorized or low-privileged users to inspect or modify global SSO configurations, potentially leading to account takeover or privilege escalation. The SSO connectivity-test function can be exploited as a server-side request forgery primitive. Furthermore, the user list API returns user objects without consistently clearing authentication-related fields. The vulnerability is addressed in version 2.0.0.

Unauthorized or low-privileged users can access and modify critical SSO configuration settings, which may result in account takeover or privilege escalation. The SSRF capability via the connectivity-test function can be leveraged to perform unauthorized internal network requests. Exposure of authentication-related fields in user objects increases the risk of information disclosure. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity.

Upgrade KubePi to version 2.0.0 or later, where this vulnerability is fixed. No official patch or temporary fix is currently documented. Until upgrading, restrict access to the SSO configuration API endpoints to trusted administrators only, if possible. Monitor for any unauthorized changes to SSO settings.