Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, supercronic, azure-aad-pod-identity-mic, k8ssandra-operator-fips, kube-fluentd-operator, volume-modifier-for-k8s, prometheus-mysqld-exporter, mc-fips, etcd, hugo, prometheus-elasticsearch-exporter-fips, kubernetes-csi-external-resizer,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, argocd-image-updater-fips, kubernetes-dashboard, argocd-image-updater, bom, kpt...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, bom, argocd-image-updater, aactl, kpt...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: flux-source-controller, slsa-verifier, bank-vaults, skopeo, kube-rbac-proxy, tkn, kargo, step-ca, guac, step, policy-controller, rekor, terragrunt, fulcio, goreleaser, grpc-health-probe, rook, k3s, kubernetes-dashboard, temporal, dex, weaviate, kubescape, gitsign,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, aws-flb-firehose, flux, kyverno, gitlab-pages, k3s, kubernetes-dashboard, kube-fluentd-operator, coredns, kubescape, libnvidia-container, kaf, cilium-cli, kine, kots, gitlab-kas, aws-flb-cloudwatch, chezmoi, snyk-cli, zot, cert-manager,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux-source-controller, slsa-verifier, nfpm, fulcio, splunk-otel-collector, syft, kubernetes-dashboard, terraform-provider-acme, terraform-provider-azurerm, crossplane-provider-azure-storage, crossplane-provider-azure-sql, crossplane-provider-aws-sqs,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: flux-source-controller, opentofu, gitea, gptscript, guac, nfpm, flux, scorecard, terragrunt, trivy-operator, splunk-otel-collector, argo-events, kyverno, k3s, syft, kubernetes-dashboard, kubescape, pulumi-kubernetes-operator, kaf, cilium-cli, kine, nuclei, kots,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: helm-operator, opentofu, newrelic-fluent-bit-output, steampipe, traefik, xeol, k8sgateway, goreleaser, ferretdb, k3s, vale, kubernetes-dashboard, thanos-operator, croc, rancher-helm, redis-operator, kubeflow-katib, cilium-cli, kubo, kine,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: slsa-verifier, metrics-server, aws-flb-firehose, configmap-reload, go-licenses, gosu, wait-for-port, oras, flannel-cni-plugin, hey, scorecard, nri-discovery-kubernetes, kubernetes-dashboard-metrics-scraper, kubeflow-katib, influx, mage, sops, aws-flb-cloudwatch,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: slsa-verifier, kuberlr, extism, metacontroller, kubernetes-csi-external-resizer, ghaudit, opencost, hey, nri-haproxy, sriov-network-device-plugin, nfs-subdir-external-provisioner, azure-workload-identity-webhook, local-static-provisioner, lvm-driver, ytt,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gotestsum, extism, kubernetes-dashboard, kube-fluentd-operator, nova, kubernetes-dns-node-cache, direnv, neuvector-dbgen, sbomqs, spire-server, trufflehog, grpcurl, fscrypt, sigstore-scaffolding, grafana-rollout-operator, grafana-agent-operator,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kuberlr, migrate, controller-gen, fulcio, nri-haproxy, kubernetes-dashboard, envconsul, cis-operator, wgcf, docker-machine-driver-harvester, terraform-mcp-server, nova, tekton-chains, dive, ip-masq-agent, aws-otel-collector, kubernetes-csi-driver-nfs, timescaledb-tun...