Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: kargo, kyverno-policy-reporter, docker-compose, prometheus-adapter-fips, argo-workflows, vexctl, helm-operator-fips, crossplane-provider-aws-cloudwatchlogs, terraform-provider-azurerm, crossplane-provider-aws, kaf, nri-prometheus, kwok, cosign-fips, bank-vaults-fips,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, aactl, bom, argocd-image-updater, kubernetes-dashboard, argocd-image-updater-fips...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: goreleaser, k3s, step, cloudflared, sigstore-scaffolding, dgraph, dex, gitsign, tkn, weaviate, spire-server, skaffold, tekton-chains, kubernetes-dashboard, minio, timestamp-authority, ko, zarf, kubescape, argo-workflows, gomplate, apko, grpc-health-probe, fulcio,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, aactl, argocd-image-updater, bom, kubernetes-dashboard...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: k3s, kine, prometheus, trivy-operator, opentelemetry-collector, gitea, pulumi-language-dotnet, argocd-image-updater, spire-server, skaffold, kubernetes, act, fscrypt, nuclei, k9s, kubernetes-dashboard, minio, pulumi-language-yaml, witness, zarf, kubescape, argo-cd,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-collector, cloudflared, tkn, spire-server, tekton-chains, crossplane-provider-aws-ec2, nuclei, k9s, kubernetes-dashboard, docker-cli-buildx, argo-cd, kubescape, mods, gomplate, crossplane-provider-aws-kinesis, external-dns, openbao,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: kine, prometheus, hubble, spire-server, kube-fluentd-operator, fuse-overlayfs-snapshotter, kubernetes, fscrypt, go, kubernetes-dashboard, kubescape, argo-cd, aws-flb-kinesis, libnvidia-container, aws-flb-firehose, ingress-nginx-controller, gitaly, gitlab-kas,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: hubble, spire-controller-manager, sriov-network-device-plugin, kubescape-operator, pgtimetable, aws-sigv4-proxy, clickhouse-operator, spire-server, fuse-overlayfs-snapshotter, kubeflow-katib, crossplane-provider-aws-ec2, kubernetes-dashboard, wave, mods,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: goreleaser, k3s, kine, src, hubble, k8sgateway, ferretdb, traefik, spire-server, fuse-overlayfs-snapshotter, kubeflow-katib, xeol, thanos-operator, kubernetes-dashboard, minio, opensearch-k8s-operator, cert-manager-cmctl, flux-notification-controller, headlamp,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: nats, nri-discovery-kubernetes, petname, gops, go-licenses, go-md2man, mage, configmap-reload, dgraph, metrics-server, oras, kubeflow-katib, k3d, flannel-cni-plugin, influx, scorecard, aws-flb-kinesis, aws-flb-firehose, nsc, ctop, kubernetes-dashboard-metrics-scraper...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: trivy-operator, hubble, cert-exporter, fuse-overlayfs-snapshotter, mods, nginx-prometheus-exporter, yq, k8ssandra-client, amazon-k8s-cni, dask-gateway, podman, pombump, glab, nri-rabbitmq, flux-helm-controller, volume-modifier-for-k8s, trillian, bento, yam, snyk-cli,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: glow, hubble, spire-controller-manager, tkn, clickhouse-operator, gcsfuse, kubeflow-katib, kubernetes-dashboard-auth, nuclei, tekton-chains, wire-go, kubernetes-dashboard, docker-cli-buildx, kpt, libnvidia-container, nginx-prometheus-exporter, nodetaint, fulcio, opa,...