Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, kpt, kubernetes-dashboard, bom, aactl, argocd-image-updater...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: policy-controller-fips, weaviate, ollama, temporal-ui-server-fips, mc, docker-compose, falcosidekick, helm-operator-fips, kubernetes-csi-driver-hostpath, secrets-store-csi-driver-provider-azure, atlantis, prometheus-adapter-fips, cluster-proportional-autoscaler,...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: nerdctl, kargo, argo-workflows, skopeo, skaffold, tekton-chains, step-ca, kots, goreleaser, policy-controller, vexctl, kube-rbac-proxy, terragrunt, cosign, falcoctl, wolfictl, dex, rook, guac, slsa-verifier, k3s, oauth2-proxy, minio, kubernetes-dashboard,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, kpt, argocd-image-updater, kubernetes-dashboard, aactl...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: nerdctl, cloud-provider-aws, runc, kine, libnvidia-container, kots, kaf, dask-gateway, mattermost, aws-flb-kinesis, aws-flb-firehose, gitlab-kas, helm, k3s, k8s-device-plugin, kubernetes, telegraf, kubernetes-dashboard, go, argo-cd, hubble, istio, prometheus-operator...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: terraform-provider-azurerm, crossplane-provider-aws-elasticache, crossplane-provider-aws-kms, mods, kine, crossplane-provider-aws-sns, sealed-secrets, terraform-provider-tls, scorecard, src, chisel, rancher-agent, gitlab-kas, k3s, pulumi-language-dotnet,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: nerdctl, witness, cloud-provider-aws, kine, opentelemetry-collector, skaffold, kots, kaf, scorecard, argocd-image-updater, nuclei, pulumi-language-yaml, terragrunt, opentofu, wolfictl, mattermost, guac, gitlab-kas, containerd, helm, k3s, kubernetes,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: eksctl, nerdctl, thanos-operator, bento, runc, kine, bom, dask-gateway, goreleaser, scorecard, src, ferretdb, conftest, terraform, kubernetes-dns-node-cache, mc, cosign, opentofu, rancher-helm, vale, mattermost, headlamp, tfsec, xeol, terraform-provider-pagerduty,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kapp-controller, azcopy, thanos-operator, crossplane-provider-aws-elasticache, paranoia, mods, kine, crossplane-provider-aws-sns, tofu-controller, sftpgo-plugin-pubsub, hubble-ui, sealed-secrets, kustomize, amass, gke-gcloud-auth-plugin, goreleaser,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, protoc-gen-go-grpc, nats, sbom-scorecard, smarter-device-manager, sonobuoy, hubble-ui, go-licenses, amass, gke-gcloud-auth-plugin, mage, scorecard, configmap-reload, sops, gosu, ip-masq-agent, grpcurl, kubernetes-dashboard-metrics-scraper,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kapp-controller, thanos-operator, libnvidia-container, src, terraform, kor, nri-redis, dex, cluster-api-provider-vsphere, headlamp, portieris, k3s, kpt, nri-mysql, render-template, nodetaint, hubble, prometheus-operator, ratify, k8sgpt, polaris, harbor-registry,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: amass, dex, rook, gitlab-cng, kubelet-csr-approver, render-template, hubble, crossplane-provider-azure, aws-signer-notation-plugin, ratify, cert-exporter, ksops, spegel, cert-manager-cmctl, gatus, yunikorn-k8shim, step, hugo-extended, atlantis, fixuid, cortex, gofump...