CVE-2024-36111mediumobserved exploitationCWE-1259

CVE-2024-36111: medium-severity vulnerability in 1Panel-dev KubePi

KubePi's JWT token validation has a defect

Published · Updated

Follow this CVE+ Monitor KubePi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.3epss 8.4%
from disclosure to weapon
Published on NVDJul 25
VulnCheck+131d
In short

KubePi, a Kubernetes management panel, has a flaw in its JWT token validation where the default security key is empty. An attacker can create fake login tokens using this empty key to bypass authentication and gain unauthorized access to the system.

Technical detail

CVE-2024-36111 affects KubePi versions 1.6.3 through 1.7.x, where JWT verification uses an empty key despite configuration logic attempting to generate a random replacement; this allows an unauthenticated attacker to forge valid JWT tokens and bypass authentication controls to access the Kubernetes management backend. The vulnerability exists in the token verification logic which does not properly utilize the generated key during actual validation.

Summary generated and translated by AI from the official description.
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
1Panel-dev · KubePi
Related CVEs — 1Panel-dev KubePi

In the same product, most dangerous first.

CVE-2023-37916MEDIUMLeak password hash of any userEPSS 0.8%CVE-2023-37917CRITICALPrivilege Escalation in kubepiEPSS 0.7%CVE-2026-65956CRITICALKubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRFEPSS 0.6%CVE-2026-69129MEDIUMKubePi: Insufficient per-cluster authorization checks in cluster management APIsEPSS 0.4%