Description

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-21T22:16:38.710Z",
  "pubdate": "2026-08-21T22:16:38.710Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Kite Kubernetes dashboard prior to version 0.12.3.\nThe vulnerability allows authenticated users with any assigned role to access sensitive aggregate Kubernetes inventory and capacity data for clusters that their specific RBAC permissions do not explicitly authorize.\nThe flaw stems from improper route registration order and insufficient privilege validation within the application logic.\nAn attacker possessing low-privilege authenticated access can leverage this defect to harvest unauthorized cross-cluster operational data.\nThe risk implication involves unauthorized information disclosure of multi-tenant or segregated cluster resources.\nExploitation requires valid user authentication within the Kite dashboard and the ability to supply a targeted cluster identifier via HTTP headers.\nRemediation requires upgrading the Kite product to version 0.12.3 or later where the access control enforcement is properly aligned with API route registration.",
  "technicalDetails": "The vulnerability resides in the API routing and authorization logic of the Kite Kubernetes dashboard.\nSpecifically, the vulnerable component involves the handling of the /api/v1/overview route and the associated GetOverview function.\nThe root cause of the vulnerability is twofold: first, the overview API route is registered prior to the execution of the middleware.RBACMiddleware() security component in the request lifecycle; second, the GetOverview function performs a superficial authorization check that merely validates len(user.Roles) > 0 rather than evaluating granular permissions against the requested resource.\nAttackers exploit this behavior by manipulating HTTP request headers.\nAn authenticated user with restricted or minimal privileges can issue a request to /api/v1/overview while injecting an unauthorized cluster name into the x-cluster-name HTTP request header.\nBecause the request bypasses middleware.RBACMiddleware() and the handler fails to validate the user's explicit authorization for the specified cluster, the application processes the request.\nThe server subsequently queries and returns aggregate Kubernetes inventory and capacity data pertaining to the unauthorized cluster back to the user.\nThe affected product is Kite in all versions prior to version 0.12.3.\nPrerequisites for this attack include network exposure to the Kite dashboard and valid user authentication credentials with at least one assigned role.\nThe post-exploitation impact is limited to unauthorized information disclosure, specifically the exposure of metadata, inventory lists, and capacity metrics from restricted Kubernetes clusters."
}