Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, bom, aactl, kpt, kubernetes-dashboard, argocd-image-updater...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, kaniko, metrics-server, certificate-transparency, actions-runner-controller, secrets-store-csi-driver-provider-aws, newrelic-nri-kube-events, flux-kustomize-controller, frp, sigstore-scaffolding, kubeflow, grpc-health-probe,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, aactl, kpt, argocd-image-updater, bom...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: fulcio, tkn, kubernetes-dashboard, dex, rekor, temporal-ui-server, wolfictl, weaviate, terragrunt, guac, temporal, cosign, spire-server, ko, bank-vaults, timestamp-authority, gitsign, caddy, k3s, rabbitmq-messaging-topology-operator, dgraph, flux-kustomize-controller...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: gitlab-kas, karpenter, kubernetes-dashboard, external-dns, aws-flb-cloudwatch, kubernetes, coredns, snyk-cli, spire-server, argo-cd, external-secrets-operator, libnvidia-container, cloud-provider-aws, k3s, fscrypt, kaf, kine, hubble, gitlab-pages, cilium, kyverno,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: tkn, crossplane-provider-aws-rds, docker, gitlab-kas, pulumi, crossplane-provider-aws-sqs, terraform-provider-acme, external-secrets-operator, kaf, crossplane-provider-aws-eks, gitlab-pages, cilium, telegraf, crossplane-provider-aws-s3, podman, aactl,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: nfpm, trivy-operator, gitlab-kas, act, kubernetes-dashboard, wolfictl, external-dns, kubernetes, guac, terragrunt, pulumi, snyk-cli, spire-server, witness, argo-cd, external-secrets-operator, k9s, cloud-provider-aws, k3s, argo-events, fscrypt, grype, kaf, kine,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, aws-flb-cloudwatch, local-path-provisioner, docker-cli, go-md2man, docker-credential-ecr-login, gops, metrics-server, k3d, protoc-gen-go-grpc, gobuster, render-template, oras, kind, cni-plugins, scorecard, slsa-verifier, nats,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, timoni, external-dns, aws-flb-cloudwatch, cosign, thanos-operator, croc, eksctl, spire-server, kubernetes-dns-node-cache, k3s, kine, conftest, xeol, hubble, redis-operator, scorecard, telegraf, mattermost, cert-manager-cmctl, vale, traefik,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, kubernetes-csi-driver-nfs, dex, timoni, ipfs-cluster, gatekeeper, local-path-provisioner, kuberay-operator, nri-nginx, dockerize, clickhouse-operator, croc, minio-operator, rabbitmq-default-user-credential-updater, cert-manager-istio-csr,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-nfs, fq, nvidia-container-toolkit, minio-operator, cert-manager-istio-csr, conftest, aws-node-termination-handler, trufflehog, nri-memcached, nri-rabbitmq, ytt, mkcert, aws-load-balancer-controller, dask-gateway, wait-for-port, gitea,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tkn, kubernetes-csi-driver-nfs, dex, ipfs-cluster, nri-nginx, clickhouse-operator, rabbitmq-default-user-credential-updater, libnvidia-container, nri-consul, conftest, kubernetes-csi-driver-hostpath, nodetaint, kor, pluto, wire-go, nri-memcached, nri-haproxy, bom,...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...