CVE-2026-65956: KubePi mounted its SSO management routes on a public path

The mistake in one sentence

KubePi is a multi-cluster Kubernetes management panel. In versions before 2.0.0, the SSO configuration module was registered on a public route instead of behind the administrative authentication check. An unauthenticated remote attacker who could reach the panel therefore reached configuration read and write functions and a connectivity test interface.

The flaw is tracked as CVE-2026-65956, and the fixed release is 2.0.0.

Why an SSO configuration page is not a minor page

Single sign-on configuration screens look administrative in the ordinary sense, in that they set policy rather than expose data. In practice they hold two things that matter more.

The first is the identity provider secret. An OIDC or SAML client secret is a credential that lets a caller impersonate the application to the identity provider. Reading it is enough to mint tokens or assertions that downstream systems accept, which transfers the impact from the panel to everything the panel's identity is trusted by.

The second is the connectivity test function. A test that asks the server to reach a supplied URL is a server-side request forgery primitive by construction. When the endpoint is unauthenticated, the attacker chooses the target. Inside a Kubernetes management environment the reachable targets include the API server, the metadata endpoints of cloud instances, and internal services that assume requests can only originate from trusted hosts.

An unauthenticated write path to SSO configuration adds a third outcome: changing the identity provider to one the attacker controls. If the panel then authenticates against that provider, the change becomes a login path rather than a data exposure.

Remediation

Upgrade to 2.0.0 or later. The version boundary is simple, which helps with the inventory step.

• Identify every KubePi instance and confirm the version before and after the upgrade.
• Treat any instance that was reachable from an untrusted network as potentially configured by an attacker: review the SSO settings, the configured identity providers and any panel accounts that were not created by the operations team.
• Review panel and Kubernetes audit logs for configuration changes and for outbound requests to unexpected hosts.
• Rotate the identity provider client secrets and any cluster credentials the panel stores.

Management panels for Kubernetes deserve the same exposure discipline as the cluster API itself. The panel holds cluster credentials in order to do its job, so its own authentication boundary is the boundary that protects those credentials. A single route registered in the wrong place removes it.

References

• KubePi security advisory for CVE-2026-65956
• NVD record for CVE-2026-65956
• Vendor release notes for KubePi 2.0.0