Improper Access Control in Kite Kubernetes Dashboard
CVE-2026-53487

4.3MEDIUM

Key Information:

Vendor

Kite-org

Status
Kite
Vendor
CVE Published:
21 August 2026

What is CVE-2026-53487?

The Kite Kubernetes dashboard, prior to version 0.12.3, exhibits improper access control where authenticated users can access sensitive cluster information. Users with any role can call the /api/v1/overview endpoint for unauthorized clusters by manipulating the x-cluster-name header. Since the overview route is registered without sufficient role-checking middleware, it exposes aggregate Kubernetes inventory and capacity data from clusters that the user should not have access to. The issue is resolved in version 0.12.3.

Affected Version(s)

kite < 0.12.3

References

https://github.com/kite-org/kite/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.