105 matches found
Kubernetes Dashboard <1.10.1 - Authentication Bypass
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...
CVE-2026-53487
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...
CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...
CVE-2026-53487
Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) > 0 rather than...
CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...
GO-2023-1772 vulnerabilities
Vulnerabilities for packages: aactl, kpt, kubernetes-dashboard, argocd-image-updater, bom, argocd-image-updater-fips...
GO-2024-2611 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard-fips, crossplane-provider-aws-route53, azure-aad-pod-identity-mic, kubeflow-pipelines, temporal-ui-server-fips, terraform-docs, kuberay-operator, frp, secrets-store-csi-driver, temporal-ui-server, minio-fips, logstash-exporter, zot, argo-workflow...
GO-2023-1772 vulnerabilities
Vulnerabilities for packages: aactl, kpt, argocd-image-updater, kubernetes-dashboard, bom...
GO-2024-2631 vulnerabilities
Vulnerabilities for packages: kots, spire-server, sigstore-scaffolding, zot, wolfictl, zarf, kubernetes-dashboard, oauth2-proxy, rook, aactl, falcoctl, flux-source-controller, cloudflared, flux-kustomize-controller, kube-rbac-proxy, tekton-chains, step-ca, step, fulcio, skaffold, sops,...
GO-2026-4864 vulnerabilities
Vulnerabilities for packages: kots, spire-server, fscrypt, gitaly, cilium-cli, newrelic-fluent-bit-output, coredns, falco-no-driver, external-secrets-operator, argo-cd, karpenter, zot, libnvidia-container, aws-flb-kinesis, kubernetes-csi-node-driver-registrar, kubernetes-dashboard, kaf, aactl,...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-eks, docker-machine-driver-linode, crossplane-provider-aws-kinesis, scorecard, zot, flux-notification-controller, falcoctl, cloudflared, nfpm, step, sops, minio, chisel, kyverno, crossplane-provider-aws-cloudwatchlogs,...
GO-2026-5015 vulnerabilities
Vulnerabilities for packages: kots, spire-server, grype, gptscript, fscrypt, cilium-cli, external-secrets-operator, argo-cd, scorecard, flux-image-automation-controller, opentofu, wolfictl, pulumi-kubernetes-operator, zarf, zot, witness, kubernetes-dashboard, kaf, aactl, flux-source-controller,...
GO-2023-2382 vulnerabilities
Vulnerabilities for packages: wait-for-port, render-template, kind, flannel-cni-plugin, go-licenses, docker-credential-ecr-login, metrics-server, scorecard, local-path-provisioner, aws-flb-kinesis, hey, sonobuoy, gops, sbom-scorecard, go-md2man, aactl, nats, gobuster, cass-operator, cni-plugins,...
GO-2026-4342 vulnerabilities
Vulnerabilities for packages: croc, headlamp, spire-server, mc, cilium-cli, newrelic-fluent-bit-output, falco-no-driver, scorecard, flux-image-automation-controller, opentofu, terraform-provider-pagerduty, kubernetes-dns-node-cache, aws-flb-kinesis, opensearch-k8s-operator, kubernetes-dashboard,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: gostatsd, newrelic-infra-operator, stakater-reloader, verticadb-operator, dkron, docker-machine-driver-linode, go-licenses, cluster-api-ipam-provider-in-cluster, docker-credential-gcr, falco-no-driver, db-operator, paranoia, crossplane-provider-aws-kinesis,...
GO-2025-3849 vulnerabilities
Vulnerabilities for packages: grafana-agent-operator, dbmate, step, logstash-exporter, harbor-scanner-trivy, gitea, kubernetes-release, kubebuilder, nfs-subdir-external-provisioner, trivy, helm, incert, rke2-cloud-provider, crossplane-provider-sql, fscrypt, kube-metrics-adapter,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: nova, migrate, docker-credential-gcr, zot, bom, falcoctl, wgcf, cloud-sql-proxy, kor, grafana-alloy, rancher-system-upgrade-controller, delve, terraform-mcp-server, emissary, nuclei, spire-controller-manager, nri-memcached, steampipe, trivy, gobump,...
CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1
Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...
CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1
Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...
CLEANSTART-2026-ZB20397 Security fixes in kubernetes-dashboard-auth-fips 1.4.0-r2
Package kubernetes-dashboard-auth-fips version 1.4.0-r2 fixes 21 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...