Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, argocd-image-updater-fips, kubernetes-dashboard, kpt, argocd-image-updater, bom...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-family-aws, goreleaser, docker-compose, logstash-exporter-fips, cortex, pulumi-kubernetes-operator, rclone, minio-fips, tigera-operator, vault-csi-provider, crossplane-provider-aws-firehose, frp, atlantis-fips,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater, kpt, kubernetes-dashboard, aactl...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: step, weaviate, skopeo, temporal-ui-server, dgraph, falcoctl, cosign, apko, gomplate, kots, tkn, fulcio, skaffold, aactl, kubernetes-dashboard, caddy, dex, zarf, spire-server, zot, sigstore-scaffolding, goreleaser, rabbitmq-messaging-topology-operator, oauth2-proxy,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-rds, step, buildkitd, podman, falcoctl, crossplane-provider-aws-kinesis, crossplane-provider-aws-elasticache, helm, gitea, aactl, skaffold, prometheus, pulumi-language-java, k8sgpt, cilium-cli, zot,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: karpenter, cert-manager, mattermost, kine, cilium, helm, gitaly, kots, newrelic-fluent-bit-output, aws-flb-firehose, aactl, kubernetes-dashboard, coredns, prometheus, fuse-overlayfs-snapshotter, runc, external-dns, ingress-nginx-controller, k8s-device-plugin,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: gptscript, cert-manager, mattermost, kine, pulumi, podman, loki, cilium, helm, apko, splunk-otel-collector, gomplate, kots, opentofu, gitea, aactl, kubernetes-dashboard, prometheus, pulumi-language-java, skaffold, dagger, pulumi-language-yaml, trivy, external-dns,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: terraform, ferretdb, opensearch-k8s-operator, mattermost, kine, xeol, cosign, helm, newrelic-fluent-bit-output, opentofu, redis-operator, aactl, kubernetes-dashboard, runc, fuse-overlayfs-snapshotter, kubernetes-dns-node-cache, external-dns, ingress-nginx-controller,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: helm-push, smarter-device-manager, ctop, dgraph, configmap-reload, hey, aws-flb-firehose, nri-discovery-kubernetes, aactl, nsc, docker-credential-ecr-login, amass, docker-cli, go-bindata, sonobuoy, kind, scorecard, nats, aws-flb-kinesis, ip-masq-agent, petname,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-rds, step, spark-operator, cluster-api-ipam-provider-in-cluster, crossplane-provider-aws-kinesis, crossplane-provider-aws-elasticache, gatekeeper, helm, metacontroller, aactl, esbuild, nri-nginx, sonobuo...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: podman, cluster-api-ipam-provider-in-cluster, ini-file, skaffold, mongo-tools, kube-bench, opa, kpt, wolfictl, nri-cassandra, pgpool2exporter, azure-ipam, kubeflow-katib, cluster-api-aws-controller, malcontent, containerd, slsa-verifier, k8ssandra-operator,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: emissary, spark-operator, buildkitd, dgraph, falcoctl, ini-file, aactl, mongo-tools, prometheus, k8sgpt, nri-nginx, kube-bench, mockgen, cilium-cli, opa, kubecolor, zot, aws-eks-pod-identity-agent, envconsul, cluster-api-azure-controller, kpt, oauth2-proxy,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...