Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, argocd-image-updater, kpt, bom, argocd-image-updater-fips, kubernetes-dashboard...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller-fips, kubernetes-event-exporter, amass, kube-oidc-proxy, kube-logging-logging-operator, k3s, rabbitmq-cluster-operator, prometheus-alertmanager-fips, step-ca, node-problem-detector, nri-discovery-kubernetes, cosign-fips,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, argocd-image-updater, kpt, bom, kubernetes-dashboard...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: caddy, flux-kustomize-controller, falcoctl, slsa-verifier, dgraph, skopeo, tekton-chains, kargo, oauth2-proxy, sigstore-scaffolding, temporal, aactl, argo-workflows, grpc-health-probe, wolfictl, k3s, policy-controller, fulcio, timestamp-authority, cloudflared, step-c...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kyverno, fuse-overlayfs-snapshotter, fscrypt, kubernetes, mattermost, go, k8s-device-plugin, cilium, ingress-nginx-controller, cert-manager, dask-gateway, argo-cd, snyk-cli, gitaly, aactl, kaf, k3s, kubernetes-csi-node-driver-registrar,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: falcoctl, tekton-chains, crossplane-provider-aws-s3, crossplane-provider-aws-eks, cert-manager, argo-cd, glab, pulumi-language-java, flux-image-automation-controller, k3s, traefik, terraform-provider-acme, nfpm, pulumi-language-dotnet, terragrunt, wal-g, k9s,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: kyverno, fscrypt, kubernetes, trivy, mattermost, gitea, nuclei, cilium, loki, pulumi-language-yaml, cert-manager, pulumi-kubernetes-operator, argo-cd, splunk-otel-collector, snyk-cli, knative-serving, aactl, kaf, pulumi-language-java, flux-image-automation-controller...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, fuse-overlayfs-snapshotter, flux-kustomize-controller, kubernetes-dashboard-api, conftest, thanos-operator, redis-operator, terraform, vale, mattermost, helm-set-status, ingress-nginx-controller, dask-gateway, timoni, k8sgateway, xeol,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gops, dgraph, flannel-cni-plugin, render-template, amass, gosu, nsc, sonobuoy, sbom-scorecard, ip-masq-agent, oras, aactl, go-md2man, scorecard, cortex, kubernetes-dashboard-metrics-scraper, vertical-pod-autoscaler, gobuster, wait-for-port,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, dkron, aws-signer-notation-plugin, git-sync, kubernetes-event-exporter, blobfuse2, pguser, terraform, amass, db-operator, crossplane-provider-aws-s3, extism, ingress-nginx-controller, golangci-lint, kubescape-operator, pvc-autoresizer,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno-notation-aws, terraform, gcsfuse, render-template, tekton-chains, mongo-tools, spark-operator, portieris, k3s, rabbitmq-cluster-operator, libnvidia-container, wal-g, kubernetes-csi-external-health-monitor, lazydocker, kube-logging-operator, dex,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, aws-signer-notation-plugin, pguser, render-template, amass, k8s-device-plugin, extism, glab, portieris, k3s, step-ca, nri-discovery-kubernetes, pombump, dbmate, apko, rabbitmq-messaging-topology-operator, hydra,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...