CVE-2026-53487 PUBLISHED

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Assigner: GitHub_M
Reserved: 09.06.2026 Published: 21.08.2026 Updated: 21.08.2026

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware() and GetOverview only checks len(user.Roles) > 0, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor kite-org
Product kite
Versions
  • Version < 0.12.3 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE