Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater, kubernetes-dashboard, kpt, aactl, argocd-image-updater-fips...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: k8sgpt, step-ca, k3s, spire-server-fips, vault-k8s, crossplane-provider-aws-rds, prometheus-mongodb-exporter, terraform, prometheus-beat-exporter, crossplane-provider-azure-sql, kubernetes-event-exporter, stakater-reloader, metallb, slsa-verifier, kaf,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, kpt, aactl, argocd-image-updater, kubernetes-dashboard...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: k3s, wolfictl, guac, policy-controller, tekton-chains, flux-source-controller, spire-server, aactl, fulcio, step-ca, caddy, apko, kargo, goreleaser, oauth2-proxy, dex, gomplate, temporal-ui-server, gitsign, rook, dgraph, kots, zot, zarf, melange, weaviate, kubescape,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: k3s, k8s-device-plugin, redka, spire-server, aactl, kaf, nerdctl, cilium, cilium-cli, cloud-provider-aws, argo-cd, aws-flb-firehose, zot, kots, fscrypt, mattermost, kubescape, karpenter, chezmoi, falco-no-driver, aws-flb-cloudwatch, kine, flux, runc, telegraf,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: buildkitd, witness, nuclei, spire-server, buildah, nerdctl, caddy, terraform-provider-tls, crossplane-provider-aws-route53, steampipe, podman, cluster-api-azure-controller, crossplane-provider-aws-cloudformation, pulumi-language-java, mattermost, melange, dagger, sop...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: k3s, wolfictl, kubernetes-dashboard, guac, gitea, flux-source-controller, witness, nuclei, spire-server, aactl, grype, kaf, cilium, nerdctl, cilium-cli, cloud-provider-aws, k9s, apko, opentofu, opentelemetry-collector, gomplate, argo-cd, podman, syft, zot, kots,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: k3s, terraform, bom, thanos-operator, xeol, redka, rancher-helm, spire-server, aactl, mc, nerdctl, cilium-cli, timoni, goreleaser, opentofu, steampipe, conftest, kubernetes-dashboard-api, kubernetes-dns-node-cache, ferretdb, mattermost, croc,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: src-fingerprint, http-echo, kapp, k3d, nri-nginx, rancher-helm, sftpgo-plugin-geoipfilter, spire-server, mc, docker-credential-ecr-login, nerdctl, secrets-store-csi-driver-provider-aws, secrets-store-csi-driver, amazon-cloudwatch-agent-operator, chart-testing,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: protoc-gen-go-grpc, gobuster, petname, grpcurl, go-md2man, k3d, cni-plugins, configmap-reload, go-bindata, nri-discovery-kubernetes, nats, aactl, vertical-pod-autoscaler, docker-credential-ecr-login, metrics-server, gke-gcloud-auth-plugin, aws-flb-firehose, hubble-ui...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: spiffe-helper, http-echo, rancher-helm, steampipe, pulumi-language-java, weaviate, dagger, otel-cli, bazelisk, karma, cert-manager-cmctl, slsa-verifier, terraform-provider-sendgrid, cluster-api-ipam-provider-in-cluster, ip-masq-agent, newrelic-nri-kube-events, bento,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-consul, buildkitd, controller-gen, envconsul, witness, kapp, k3d, kubernetes-dashboard-auth, nri-nginx, nuclei, emissary, kubernetes-csi-external-health-monitor, caddy, amazon-cloudwatch-agent-operator, chart-testing, steampipe, cluster-api-azure-controller,...