Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, kpt, kubernetes-dashboard, argocd-image-updater, argocd-image-updater-fips, bom...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: dagger, temporal-ui-server-fips, logstash-exporter-fips, flux-source-controller, kubernetes-dashboard-fips, flannel, skopeo, zot, dynamic-localpv-provisioner, logstash-exporter, flux-image-reflector-controller, boring-registry-fips, crossplane-provider-aws-iam,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, argocd-image-updater, bom, aactl, kubernetes-dashboard...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: argo-workflows, ko, skopeo, step-ca, policy-controller, cosign, grpc-health-probe, kargo, wolfictl, kubescape, goreleaser, temporal-ui-server, vexctl, flux-source-controller, nerdctl, slsa-verifier, temporal, melange, aactl, rook, bank-vaults, k3s,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: teleport, cilium, cloud-provider-aws, crossplane-provider-azure-managedidentity, prometheus, wolfictl, knative-serving, cilium-cli, crossplane-provider-aws-route53, traefik, flux-source-controller, loki, nerdctl, external-dns, go-discover, melange, containerd,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: cilium, cloud-provider-aws, gitlab-kas, gitaly, prometheus, kaf, kubescape, fuse-overlayfs-snapshotter, newrelic-fluent-bit-output, telegraf, chezmoi, prometheus-operator, karpenter, cilium-cli, kube-fluentd-operator, dask-gateway, falco-no-driver, nerdctl,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: cilium, scorecard, cloud-provider-aws, gitlab-kas, prometheus, osv-scanner, opentofu, splunk-otel-collector, argocd-image-updater, kaf, wolfictl, kubescape, argo-events, grype, telegraf, chezmoi, prometheus-operator, gptscript, knative-serving, cilium-cli,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: gosu, kind, gops, scorecard, flannel-cni-plugin, nri-discovery-kubernetes, go-bindata, local-path-provisioner, cass-operator, configmap-reload, vertical-pod-autoscaler, amass, helm-push, wait-for-port, gobuster, k3d, docker-credential-ecr-login, nats, render-template...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: k8sgateway, scorecard, flux-notification-controller, headlamp, tfsec, croc, cosign, osv-scanner, opentofu, steampipe, rancher-helm, newrelic-fluent-bit-output, fuse-overlayfs-snapshotter, telegraf, goreleaser, gitness, cert-manager-cmctl, cilium-cli, dask-gateway,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kor, cert-manager-istio-csr, cloud-provider-aws, aws-privateca-issuer, juicefs, azure-workload-identity-webhook, kubernetes-csi-driver-nfs, yace, tetragon, sftpgo-plugin-auth, amass, aws-eks-pod-identity-agent, k3d, maru, nginx-prometheus-exporter, flannel, cilium-cl...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: cilium, nri-discovery-kubernetes, azure-workload-identity-webhook, wolfictl, amass, trufflehog, lazygit, aws-flb-firehose, ipfs-cluster, rancher-telemetry, ghaudit, sftpgo-plugin-kms, snyk-cli, cfssl, harbor-registry, conftest, kaniko, flux-kustomize-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kor, kubernetes-csi-driver-nfs, emissary, aws-privateca-issuer, lazydocker, mockgen, glow, prometheus, aws-otel-collector, aws-eks-pod-identity-agent, grafana-alloy, k3d, nginx-prometheus-exporter, cilium-cli, kubeflow-katib, ipfs-cluster, containerd, nri-consul,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...