CVE-2026-65956 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
Unauthenticated access to SSO configuration allows attackers to modify authentication settings, leading to admin account takeover and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65956?
CVE-2026-65956 is a critical missing authorization vulnerability in 1Panel-dev KubePi, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.
Weakness: CWE-306
Which versions are affected by CVE-2026-65956?
How do I fix CVE-2026-65956?
No fix has been published for CVE-2026-65956 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-65956 being exploited?
There is no known exploitation of CVE-2026-65956 in the wild and no public exploit code.
Sources
Also known as GHSA-wjrh-4j52-c664.