Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

EUVD-2026-64181

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) &gt; 0 rather than...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-53487: Missing Authorization

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: nri-discovery-kubernetes, crossplane-provider-aws-rds, conftest-fips, metrics-server-fips, pulumi-language-dotnet, node-problem-detector, gitsign, k8sgpt, crossplane-provider-azure, metrics-server, step-ca, nats, nri-kubernetes, terraform-provider-google, tflint,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kpt, aactl, argocd-image-updater-fips, bom, argocd-image-updater, kubernetes-dashboard...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, kpt, kubernetes-dashboard, argocd-image-updater, aactl...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: dgraph, cloudflared, wolfictl, ko, skaffold, vexctl, sigstore-scaffolding, slsa-verifier, step, kots, sops, fulcio, gitsign, minio, tkn, zot, spire-server, nerdctl, aactl, dex, weaviate, caddy, k3s, frp, kargo, goreleaser, kube-rbac-proxy, melange, guac, skopeo,...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: gitlab-kas, kaf, aws-flb-kinesis, coredns, cilium, hubble, cilium-cli, kots, aws-flb-firehose, aws-flb-cloudwatch, gitaly, kubernetes, libnvidia-container, zot, go, spire-server, nerdctl, ingress-nginx-controller, aactl, istio, karpenter, k3s, runc, snyk-cli, kyverno...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: vault-benchmark, osv-scanner, pulumi-language-java, teleport, crossplane-provider-aws-sns, crossplane-provider-aws-cloudfront, go-discover, gitea, tkn, kubernetes, atlantis, k8sgpt, crossplane-provider-azure-managedidentity, tflint, k3s, step-issuer, melange,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: gitlab-kas, gptscript, kaf, osv-scanner, datadog-agent, wolfictl, pulumi-language-java, dagger, containerd, loki, skaffold, scorecard, cilium, nfpm, pulumi-language-yaml, argo-events, cilium-cli, grype, kots, gitea, minio, zot, kubernetes, spire-server, trivy-operato...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: dgraph, helm-push, mage, configmap-reload, vertical-pod-autoscaler, aws-flb-kinesis, scorecard, cni-plugins, slsa-verifier, sops, go-md2man, docker-cli, aws-flb-firehose, aws-flb-cloudwatch, smarter-device-manager, wait-for-port, oras, protoc-gen-go-grpc,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: vale, osv-scanner, aws-flb-kinesis, headlamp, scorecard, steampipe, thanos-operator, hubble, cilium-cli, opensearch-k8s-operator, terraform, croc, bento, bom, aws-flb-cloudwatch, minio, helm-set-status, spire-server, nerdctl, flux-notification-controller, aactl,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: sbomqs, metacontroller, osv-scanner, vault-benchmark, actions-runner-controller, crossplane-provider-aws-sns, container-object-storage-interface, crossplane-provider-aws-cloudfront, stakater-reloader, calico, terraform-mcp-server, authservice, octo-sts, croc,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-apache, terraform-mcp-server, controller-gen, wait-for-port, tkn, libnvidia-container, k8sgpt, kapp, ip-masq-agent, k8sgateway, tflint, k3s, kubernetes-dashboard-auth, opa, yunikorn-k8shim, cluster-api-provider-vsphere, rancher-system-agent,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, licenseclassifier, k8sgpt, kbld, tflint, step-issuer, memcached-exporter, sftpgo-plugin-eventstore, kubernetes-dashboard-api, kube-logging-operator, paranoia, lazygit, nvidia-container-toolkit, glow, gops, cluster-proportional-autoscaler, spegel...