Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: terraform-provider-google, prometheus-node-exporter-fips, terraform-provider-sendgrid-fips, kubeflow-pipelines, hugo-extended, certificate-transparency, cloud-sql-proxy-fips, caddy, kuberay-operator, kor, kube-fluentd-operator, flux-notification-controller, velero,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, bom, argocd-image-updater, kpt, kubernetes-dashboard, aactl...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, argocd-image-updater, bom, kpt, kubernetes-dashboard...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: wolfictl, flux-kustomize-controller, rook, timestamp-authority, step-ca, oauth2-proxy, gomplate, zot, guac, apko, cosign, rekor, melange, policy-controller, vexctl, kubescape, sops, dgraph, ko, bank-vaults, skaffold, goreleaser, argo-workflows, skopeo, terragrunt,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, flux-kustomize-controller, crossplane-provider-aws-kms, buildah, helm, atlantis, gatus, zot, crossplane-provider-aws-kinesis, rancher, apko, cosign, docker-compose, osv-scanner, pulumi-language-dotnet, crossplane-provider-aws-sqs,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: cilium, mattermost, runc, helm, external-secrets-operator, chezmoi, zot, argo-cd, telegraf, kubescape, gitaly, karpenter, prometheus, cert-manager, prometheus-operator, aws-flb-kinesis, libnvidia-container, k8s-device-plugin, fuse-overlayfs-snapshotter,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, wolfictl, cilium, mattermost, containerd, helm, external-secrets-operator, chezmoi, k9s, pulumi-kubernetes-operator, argo-cd, gomplate, dagger, apko, guac, pulumi-language-dotnet, gitea, melange, nuclei, osv-scanner, telegraf, trivy,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, flux-kustomize-controller, mattermost, eksctl, mc, rancher-helm, runc, xeol, helm, headlamp, kubo, timoni, kubernetes-dns-node-cache, kubeflow-katib, cert-manager-cmctl, traefik, telegraf, terraform, cosign, osv-scanner,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: amass, docker-credential-ecr-login, go-bindata, influx, local-path-provisioner, kubeflow-katib, vertical-pod-autoscaler, gosu, ip-masq-agent, kind, protoc-gen-go-grpc, cortex, petname, sops, smarter-device-manager, dgraph, nsc, metrics-server, scorecard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, amass, flux-kustomize-controller, descheduler, openbao-k8s, kor, rancher-helm, timescaledb-parallel-copy, helm, sriov-network-device-plugin, kubernetes-dns-node-cache, gatus, kubeflow-katib, swagger, crossplane-provider-aws-kinesis,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: spiffe-helper, timescaledb-parallel-copy, swagger, atlantis, gatus, trillian, apko, argo-workflows, fuse-overlayfs-snapshotter, mongo-tools, malcontent, kapp-controller, amazon-cloudwatch-agent, cass-operator, kaf, cfssl, bento, gitness, thanos, azure-ipam,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kor, nri-mysql, swagger, kubeflow-katib, yunikorn-k8shim, kpt, zot, glow, cloud-provider-vsphere, kubecolor, kubernetes-csi-driver-hostpath, fulcio, spark-operator, tkn, mongo-tools, step-kms-plugin, delve, chart-testing, gcsfuse, wgcf, k3d, kapp-controller, gptscrip...