Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: crossplane, sops, certificate-transparency, dex-fips, falcosidekick-fips, kube-state-metrics, pulumi-language-java, secrets-store-csi-driver-provider-gcp, trivy, temporal, fulcio, boring-registry-fips, crossplane-provider-aws-rds, metrics-server, grafana-operator,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, aactl, kubernetes-dashboard, kpt, bom, argocd-image-updater...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: sops, apko, rabbitmq-messaging-topology-operator, spire-server, bank-vaults, ko, goreleaser, cloudflared, gomplate, kots, kargo, kubescape, step, melange, temporal, guac, rook, k3s, minio, rekor, vexctl, kube-rbac-proxy, wolfictl, zarf, cosign, terragrunt, step-ca,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, aactl, argocd-image-updater, bom, kubernetes-dashboard...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: kine, apko, grype, external-dns, pulumi-language-java, spire-server, kyverno, flux-image-automation-controller, chezmoi, loki, trivy, gitlab-kas, gitea, kots, kubescape, falco-no-driver, gomplate, prometheus, melange, splunk-otel-collector, podman, pulumi,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: go, kine, spire-server, kyverno, newrelic-fluent-bit-output, chezmoi, runc, gitlab-kas, kubescape, kots, falco-no-driver, prometheus, coredns, external-secrets-operator, prometheus-operator, cilium-cli, aws-flb-firehose, ingress-nginx-controller, fscrypt, mattermost,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: sops, crossplane-provider-aws-cloudwatchlogs, rancher, loki, neuvector-sigstore-interface, crossplane-provider-aws-sqs, ko, falco-no-driver, crossplane-provider-aws-elasticache, crossplane-provider-aws-cloudfront, teleport, crossplane-provider-aws-memorydb, gh,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: hey, rancher-helm, sops, crossplane-provider-aws-cloudwatchlogs, spqr, timescaledb-parallel-copy, grafana-rollout-operator, volume-modifier-for-k8s, kuma, paranoia, terraform, rabbitmq-cluster-operator, neuvector-sigstore-interface, whereabouts,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: rancher-helm, kine, kubo, spire-server, terraform, src, gitness, tfsec, vale, flux-image-automation-controller, newrelic-fluent-bit-output, headlamp, runc, croc, goreleaser, falco-no-driver, xeol, kubeflow-katib, redis-operator, steampipe, cilium-cli, eksctl, bento,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: ctop, hey, sops, cni-plugins, nats, ip-masq-agent, oras, flannel-cni-plugin, k3d, smarter-device-manager, kubeflow-katib, sbom-scorecard, wait-for-port, docker-cli, hubble-ui, render-template, nsc, aws-flb-firehose, local-path-provisioner, go-licenses,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: nri-memcached, paranoia, gobump, atlantis, kpt, hydra, cosign, fscrypt, mc, terraform-provider-kubernetes, sigstore-scaffolding, sftpgo-plugin-kms, openbao-k8s, k6, kubernetes-dashboard-api, opentelemetry-collector-contrib, harbor-registry, kubernetes-dns-node-cache,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-memcached, delve, grafana-rollout-operator, terraform, polaris, ini-file, rabbitmq-cluster-operator, gobump, neuvector-sigstore-interface, fzf, ko, clickhouse-operator, kapp, kube-logging-operator, wait-for-port, render-template, kpt, cilium-cli, containerd,...