CVE-2026-44514CWE-1385

Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users

Medium · published May 14, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. This is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability and affects both the desktop deployment (default http://localhost:7500) and cluster deployments (typically behind an Ingress with HTTP basic auth). This vulnerability is fixed in 0.14.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-1385 · Missing Origin Validation in WebSockets
Published
2026-05-14T16:20Z
EPSS history
Timeline
  • 14 MAY 16:20Z
    Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users
    cvelistv5