CVE-2026-53487CWE-862broken-access-control

CVE-2026-53487

Medium · published August 22, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-22T02:16Z
References (2)
https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8 · [email protected]https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 AUG 21:35Z
    Kite has an authenticated cluster RBAC bypass in /api/v1/overview
    cvelistv5