External risk intelligence

KubePi Unauthorized Access to SSO Configuration and Account Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-65956

KubePi is a management panel for Kubernetes clusters. As a multi-cluster management application designed for centralized administration, it is commonly deployed as an internet-facing or edge-reachable service to provide access to management interfaces, making its API and login endpoints likely to be exposed in typical real-world deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability in KubePi, a management panel for Kubernetes. The issue allows unauthorized users to access and alter Single Sign-On (SSO) configurations, potentially leading to account takeovers or elevated privileges. A related function could also be exploited for server-side request forgery.

Unprotected Kubernetes management panel configuration.
Unauthorized access could compromise accounts.
Confirm relevance to your environment.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Single Sign-On (SSO) configuration API endpoints of KubePi because they are exposed on the same public boundary as the login and callback endpoints. This allows unauthorized users to view or change authentication settings, potentially leading to account takeover or escalated privileges. Additionally, the SSO connectivity-test feature can be used for server-side request forgery.

No administrator authorization needed to access API.
Maliciously alter SSO configuration settings.
Account takeover or privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

An unauthorized user could gain access to sensitive authentication configurations for KubePi, a Kubernetes management panel. This exposure could lead to account takeover or privilege escalation when supported by the advisory's conditions, and the connectivity-test function might be abused for server-side request forgery.

System authentication configurations.
Unauthorized API access.
Account takeover or privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in KubePi, a Kubernetes management panel, impacts its SSO configuration, potentially allowing unauthorized users to alter authentication settings and gain account access or escalate privileges. The first practical step is to identify all KubePi instances, determine their exposure and business criticality, locate the accountable owner, and then plan remediation.

Platform or infrastructure teams own the issue.
Verify SSO endpoints and administrator access controls.
Plan maintenance for configuration review and update.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is KubePi?

KubePi is a web-based dashboard used for centralized management of multiple Kubernetes clusters. It acts as a control plane, allowing administrators to oversee various cluster operations through a unified interface rather than interacting with each cluster individually.

What is the vulnerability in CVE-2026-65956?

This vulnerability involves a missing authentication check, classified as CWE-306. It occurs because the API endpoints responsible for managing Single Sign-On (SSO) settings—such as OIDC and SAML configurations—are left unprotected. This allows individuals without administrative permissions to view or modify authentication settings, potentially enabling them to hijack accounts or elevate their access levels.

Do I need to be logged in to trigger this bug?

No, you do not need to be logged in. The vulnerability stems from the SSO configuration API endpoints sharing the same public routing boundary as the public-facing login pages. This means an attacker can reach these sensitive management functions without providing any valid administrative credentials.

Why is this CVE concerning for my network?

KubePi is often deployed as an edge-reachable service to enable remote cluster management. According to Halo Surface Signal, this makes the application highly likely to be internet-facing. Because the affected endpoints are exposed publicly, attackers can reach them from the internet, making it a critical concern for any KubePi instance accessible outside your internal network.

How do I respond to this KubePi vulnerability?

The primary step is to locate all KubePi instances running in your environment and confirm if they are running a version prior to 2.0.0. Once you have identified your installations, coordinate with the platform or infrastructure teams responsible for those systems to prioritize an upgrade to version 2.0.0, which contains the necessary security fixes for these API endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.