Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, kubernetes-dashboard, argocd-image-updater-fips, kpt, aactl, argocd-image-updater...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: gomplate, pulumi, dex, certificate-transparency, dgraph, kubernetes-dashboard-fips, prometheus-pushgateway-fips, gotenberg, atlantis-fips, grpcurl, terragrunt, cloud-sql-proxy-fips, temporal-fips, newrelic-infrastructure-agent, terraform-provider-sendgrid-fips,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater, kubernetes-dashboard, kpt, aactl...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: cosign, rook, skopeo, zot, falcoctl, gomplate, step-ca, grpc-health-probe, flux-kustomize-controller, sigstore-scaffolding, ko, guac, temporal-ui-server, kots, kubernetes-dashboard, terragrunt, rabbitmq-messaging-topology-operator, rekor, policy-controller,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: prometheus-operator, aws-flb-firehose, helm, telegraf, zot, kine, karpenter, redka, coredns, kots, kubernetes-dashboard, kubescape, cloud-provider-aws, newrelic-fluent-bit-output, spire-server, k3s, gitlab-kas, dask-gateway, aws-flb-kinesis, external-dns,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, flux-notification-controller, prometheus-operator, buildah, dagger, zot, docker-compose, gomplate, gitea, docker-machine-driver-linode, podman, argo-events, buildkitd, crossplane-provider-aws-sns, crossplane-provider-aws-dynamodb,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, prometheus-operator, scorecard, dagger, trivy, helm, telegraf, gomplate, kine, gitea, zot, flux-image-automation-controller, grype, splunk-otel-collector, guac, podman, argo-events, kots, kubernetes-dashboard, kubescape, terragrunt, act,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: bom, flux-notification-controller, cosign, k8sgateway, scorecard, helm, redis-operator, telegraf, kine, opensearch-k8s-operator, helm-set-status, croc, flux-kustomize-controller, kubernetes-dashboard-api, kubernetes-dns-node-cache, flux-image-automation-controller,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: mage, scorecard, smarter-device-manager, aws-flb-firehose, grpcurl, sonobuoy, nsc, sbom-scorecard, oras, go-bindata, hubble-ui, wait-for-port, flannel-cni-plugin, nri-discovery-kubernetes, kind, go-md2man, slsa-verifier, vertical-pod-autoscaler, configmap-reload,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, apache-exporter, azure-workload-identity-webhook, k8sgateway, opencost, opensearch-k8s-operator, helm-set-status, docker-machine-driver-linode, spire-controller-manager, kubernetes-dns-node-cache, redka, blobfuse2, esbuild,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, ini-file, prometheus-operator, k8sgateway, zot, dive, helm-set-status, nova, spire-controller-manager, cloud-sql-proxy, regclient, wait-for-port, argo-events, buildkitd, kapp-controller, aws-privateca-issuer, nodetaint, mongo-tools,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: ini-file, skopeo, nova, podman, nri-kafka, fq, boring-registry, configmap-reload, mongo-tools, kubebuilder, kubo, xeol, kube-logging-operator-custom-runner, helm-mapkubeapis, timescaledb-parallel-copy, secrets-store-csi-driver-provider-gcp, helm, guac,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...