Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, argocd-image-updater-fips, argocd-image-updater, kpt, aactl, kubernetes-dashboard...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, newrelic-infra-operator, nodetaint, bank-vaults, prometheus-bind-exporter, crossplane-provider-gcp, fulcio-fips, kyverno-policy-reporter, kine, hubble, temporal-server, kubernetes-csi-external-resizer, secrets-store-csi-driver-provider-azure,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, bom, kubernetes-dashboard, argocd-image-updater, aactl...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: ko, sigstore-scaffolding, spire-server, dgraph, gitsign, temporal, apko, step-ca, flux-source-controller, kube-rbac-proxy, tekton-chains, kots, temporal-ui-server, melange, bank-vaults, guac, slsa-verifier, zarf, argo-workflows, zot, frp, cosign, rekor, minio,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: cert-manager, cilium-cli, spire-server, snyk-cli, go, ingress-nginx-controller, karpenter, aws-flb-kinesis, kubernetes, datadog-agent, mattermost, chezmoi, fscrypt, cilium, libnvidia-container, kots, argo-cd, nerdctl, kine, fuse-overlayfs-snapshotter, redka,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, terraform-provider-tls, argo-events, crossplane-provider-aws-kms, kubernetes, apko, datadog-agent, mattermost, gitea, kots, guac, crossplane-provider-aws-iam, sealed-secrets, crossplane-provider-aws-cloudfront, cosign, dagger, falcoctl,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: nuclei, cert-manager, cilium-cli, argo-events, spire-server, snyk-cli, opentelemetry-collector, k9s, gptscript, kubernetes, apko, datadog-agent, mattermost, flux-source-controller, chezmoi, fscrypt, cilium, gitea, kots, melange, argo-cd, pulumi-kubernetes-operator,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: helm-set-status, kubeflow-katib, cilium-cli, tfsec, croc, bom, cert-manager-cmctl, spire-server, vale, ingress-nginx-controller, rancher-helm, kubernetes-dashboard-api, mc, aws-flb-kinesis, flux-notification-controller, mattermost, nerdctl, kine,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: helm-push, kubeflow-katib, amass, docker-credential-ecr-login, protoc-gen-go-grpc, cortex, grpcurl, dgraph, kubernetes-dashboard-metrics-scraper, cni-plugins, docker-cli, gke-gcloud-auth-plugin, go-licenses, aws-flb-kinesis, oras, nats, cass-operator,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio-object-browser, helm-set-status, crossplane-provider-aws-s3, wuzz, kubernetes-dashboard-metrics-scraper, grafana-operator, undock, opencost, mc, pguser, pgtimetable, kapp, conjur-cli, rabbitmq-default-user-credential-updater, mattermost, tetragon, gogatekeeper,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, cni-plugins, glow, kapp, rabbitmq-default-user-credential-updater, tempo, dive, guac, pluto, ipfs-cluster, nri-apache, falcoctl, yunikorn-k8shim, wgcf, kor, fzf, kubernetes-csi-driver-hostpath, emissary, dex, headlamp, render-template,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: helm-set-status, incert, certificate-transparency, kubevela, mc, kubernetes, apko, smarter-device-manager, gitea, bento, kubelet-csr-approver, grafana-agent-operator, malcontent, cosign, petname, apache-exporter, xeol, kube-logging-operator-custom-runner, dex,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...

CLEANSTART-2026-MX87072 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r2

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r2 fixes 22 vulnerabilities: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32280, CVE-2026-32281...