CVE-2024-36111— KubePi's JWT token validation has a defect
Quick assessment
Affected
1Panel-dev KubePi
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
KubePi是1Panel-dev开源的一个K8s面板。它允许管理员导入多个Kubernetes集群，并且通过权限控制，将不同cluster、namespace的权限分配给指定用户。 KubePi 1.6.3版本至1.8.0之前版本存在安全漏洞，该漏洞源于kubepi jwttoken校验存在缺陷，允许使用空密钥生成jwttoken可绕过登录校验，直接接管后台。
Possible ATT&CK Techniques 1 AI
T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-36111
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KubePi's JWT token validation has a defect
Source: CVE Program / CVE List V5
Vulnerability Description
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the key is detected to be empty in the configuration file reading logic, the key is empty during actual verification. Using an empty key to generate a JWT token can bypass the login verification and directly take over the back end. Version 1.8.0 contains a patch for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1259
Source: CVE Program / CVE List V5
Vulnerability Title
KubePi 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
KubePi是1Panel-dev开源的一个K8s面板。它允许管理员导入多个Kubernetes集群，并且通过权限控制，将不同cluster、namespace的权限分配给指定用户。 KubePi 1.6.3版本至1.8.0之前版本存在安全漏洞，该漏洞源于kubepi jwttoken校验存在缺陷，允许使用空密钥生成jwttoken可绕过登录校验，直接接管后台。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| 1Panel-dev | KubePi | >= 1.6.3, < 1.8.0 | - |
|
II. Public POCs for CVE-2024-36111
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-36111
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-36111 (1)
-
https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-8q5r-cvcw-4wx7 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: KubePi
-
CVE-2026-65956
KubePi: Unauthenticated SSO/OIDC configuration allows admin -
CVE-2026-69129
KubePi: Insufficient per-cluster authorization checks in clu -
CVE-2023-37916
Leak password hash of any user -
CVE-2023-37917
Privilege Escalation in kubepi -
CVE-2023-22478
KubePi is vulnerable to missing authorization
Same vendor: 1Panel-dev
-
CVE-2026-79919
MaxKB function-library sandbox escape: dlopen stack-check by -
CVE-2026-79918
MaxKB: Sandbox escape via unhooked fexecve -
CVE-2026-77517
MaxKB cross-knowledge IDOR lets a normal user read and modif -
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution -
CVE-2026-77522
MaxKB: Authenticated full-read SSRF via the knowledge web-do
Same weakness: CWE-1259
-
CVE-2026-76413
Cisco Secure Firewall Management Center Software Single Sign -
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload -
CVE-2026-25700
Apache Answer: AdminToken not invalidated after admin deacti -
CVE-2026-40264
OpenBao's Token Store Allows Cross-Namespace Renewal, Revoca -
CVE-2024-45448
Huawei HarmonyOS 安全漏洞
V. Comments for CVE-2024-36111
No comments yet