H3-2026-1070¶
KubePi Unauthenticated WebKubectl Terminal Access Vulnerability
| Category | VULNERABILITY |
| Base Score | 10.0 |
Description¶
Fit2Cloud KubePi contains a missing authorization check in its webkubectl reverse proxy handler. The handler forwards requests to an embedded GoTTY terminal server without first verifying the caller's session or JWT token, so the routing layer meant to gate access to the interactive shell never runs. Remote attackers who can reach the KubePi webkubectl endpoint retrieve a valid gotty_auth_token and connect directly to the GoTTY WebSocket terminal. Exploitation requires only network access to the KubePi instance, no credentials or prior session, and is tracked as CVE-2023-22478.
Impact¶
Remote attackers obtain an interactive shell with kubectl privileges against the managed Kubernetes cluster. This permits reading secrets, deploying arbitrary workloads, and pivoting laterally across every namespace the KubePi service account can reach. Organizations using KubePi for cluster administration face full cluster compromise. The exposure persists for as long as the proxy handler remains reachable unpatched.