CVE-2026-53487

Received Received - Intake

Kite Kubernetes Dashboard Unauthorized Cluster Data Exposure

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53487

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Kite is a Kubernetes dashboard. A vulnerability exists in versions before 0.12.3 where authenticated users with any role can access cluster overview data for clusters they are not authorized to view by specifying the cluster name in a request. The issue occurs because the overview route is checked before role-based access control middleware, allowing unauthorized data exposure.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive Kubernetes cluster information such as inventory and capacity data from restricted clusters. While it does not allow modification or deletion of data, it could lead to information leakage that might be used for further attacks or compliance violations.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing sensitive cluster data to unauthorized users. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. Unauthorized access may violate these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade Kite to version 0.12.3 or later to address the RBAC bypass in the /api/v1/overview endpoint.

Hi! I’m here to help you understand CVE-2026-53487. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70