Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, kpt, kubernetes-dashboard, argocd-image-updater, bom, argocd-image-updater-fips...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, crossplane-provider-aws-route53, azure-aad-pod-identity-mic, kubeflow-pipelines, temporal-ui-server-fips, terraform-docs, kuberay-operator, frp, secrets-store-csi-driver, temporal-ui-server, minio-fips, logstash-exporter, zot, argo-workflow...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: aactl, kpt, argocd-image-updater, kubernetes-dashboard, bom...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: kots, spire-server, sigstore-scaffolding, zot, wolfictl, zarf, kubernetes-dashboard, oauth2-proxy, rook, aactl, falcoctl, flux-source-controller, cloudflared, flux-kustomize-controller, kube-rbac-proxy, tekton-chains, step-ca, step, fulcio, skaffold, sops,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: kots, spire-server, fscrypt, gitaly, cilium-cli, newrelic-fluent-bit-output, coredns, falco-no-driver, external-secrets-operator, argo-cd, karpenter, zot, libnvidia-container, aws-flb-kinesis, kubernetes-csi-node-driver-registrar, kubernetes-dashboard, kaf, aactl,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, docker-machine-driver-linode, crossplane-provider-aws-kinesis, scorecard, zot, flux-notification-controller, falcoctl, cloudflared, nfpm, step, sops, minio, chisel, kyverno, crossplane-provider-aws-cloudwatchlogs,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: kots, spire-server, grype, gptscript, fscrypt, cilium-cli, external-secrets-operator, argo-cd, scorecard, flux-image-automation-controller, opentofu, wolfictl, pulumi-kubernetes-operator, zarf, zot, witness, kubernetes-dashboard, kaf, aactl, flux-source-controller,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: wait-for-port, render-template, kind, flannel-cni-plugin, go-licenses, docker-credential-ecr-login, metrics-server, scorecard, local-path-provisioner, aws-flb-kinesis, hey, sonobuoy, gops, sbom-scorecard, go-md2man, aactl, nats, gobuster, cass-operator, cni-plugins,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: croc, headlamp, spire-server, mc, cilium-cli, newrelic-fluent-bit-output, falco-no-driver, scorecard, flux-image-automation-controller, opentofu, terraform-provider-pagerduty, kubernetes-dns-node-cache, aws-flb-kinesis, opensearch-k8s-operator, kubernetes-dashboard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gostatsd, newrelic-infra-operator, stakater-reloader, verticadb-operator, dkron, docker-machine-driver-linode, go-licenses, cluster-api-ipam-provider-in-cluster, docker-credential-gcr, falco-no-driver, db-operator, paranoia, crossplane-provider-aws-kinesis,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: grafana-agent-operator, dbmate, step, logstash-exporter, harbor-scanner-trivy, gitea, kubernetes-release, kubebuilder, nfs-subdir-external-provisioner, trivy, helm, incert, rke2-cloud-provider, crossplane-provider-sql, fscrypt, kube-metrics-adapter,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nova, migrate, docker-credential-gcr, zot, bom, falcoctl, wgcf, cloud-sql-proxy, kor, grafana-alloy, rancher-system-upgrade-controller, delve, terraform-mcp-server, emissary, nuclei, spire-controller-manager, nri-memcached, steampipe, trivy, gobump,...

CLEANSTART-2026-RS31344 Security fixes in kubernetes-dashboard 7.14.0-r1

Package kubernetes-dashboard version 7.14.0-r1 fixes 21 vulnerabilities: CVE-2026-27140, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...

CLEANSTART-2026-ZB20397 Security fixes in kubernetes-dashboard-auth-fips 1.4.0-r2

Package kubernetes-dashboard-auth-fips version 1.4.0-r2 fixes 21 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...