CVE-2024-36111 is a critical vulnerability affecting KubePi versions 1.6.3 through 1.7.x, where a defect in JWT token verification allows for authentication bypass. The system incorrectly uses an empty JWT key for verification, enabling attackers to craft tokens and gain unauthorized backend access. With a CVSS score of 6.3 (Medium) and an EPSS score indicating higher exploitability than 98% of CVEs, this flaw presents a significant risk due to its low attack complexity and potential for compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the high FAUCET Risk Score of 97/100 underscores its severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| 1Panel-Dev | KubePi | >= 1.6.3, < 1.8.0CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.