KubePi CVE-2026-65956

No authentication is required to reach the vulnerable endpoints: the CVSS vector is PR:N/UI:N and the fix confirms the SSO management routes were registered on the public routing boundary, so an attacker only needs network reachability to the KubePi panel. Concretely, the exposed operations are the SSO config read/create/update endpoints, the OpenID callback handler, and the /sso/test/connect connectivity test, plus the user-list API that returned authentication fields. Limiting factors: full account takeover / privilege escalation is described as achievable only 'under certain conditions,' meaning it depends on the specific SSO/OIDC/SAML deployment and whether SSO is enabled and integrated with privileged accounts; the config-disclosure, config-tampering, SSRF, and credential-field-leak effects, however, do not require those special conditions. Realistic risk is highest where the KubePi panel is network-reachable by untrusted users and SSO is actively configured.

This is a genuine high-priority issue, not an inflated CVSS score. The vendor CVSS 4.0 base is 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact), and the mechanism is straightforward: unauthenticated HTTP requests to management endpoints that should have been admin-gated, corroborated directly by the fix commit adding the missing authorization checks. That code-level evidence raises confidence well above a description-only rating. The most severe outcome - account takeover / privilege escalation - is described as conditional ('under certain conditions'), so real-world impact depends on how SSO is deployed, which tempers the theoretical 10.0 somewhat; however, the SSRF primitive and leakage of authentication fields are unconditional and independently useful to an attacker. No CISA KEV listing and no public exploit are indicated, and no EPSS score was supplied, so exploitation is unproven in the wild - but for a Kubernetes control-plane management panel the exposure of authentication configuration to anonymous users is severe enough that any operator running KubePi ≤1.6.15 on a reachable network should treat patching as urgent. Missing signals: EPSS and KEV data were not provided and cannot be inferred.

An attacker who can reach the KubePi web interface sends unauthenticated requests to the SSO management endpoints to read the current OIDC/SAML configuration and to POST a modified configuration pointing authentication at attacker-controlled infrastructure, then leverages the SSO connectivity-test endpoint to make the server issue requests to internal resources (SSRF) and queries the user-list API to collect leaked authentication-related fields. Under a suitable SSO setup this chain enables account takeover or privilege escalation to administrator. No public exploit is identified at time of analysis, but the low complexity and unauthenticated network vector make weaponization straightforward.