Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| kite-org | kite | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-gvhc-wv3v-7pf8 | Kite has an authenticated cluster RBAC bypass in /api/v1/overview |
Fri, 21 Aug 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue. | |
| Title | Kite has an authenticated cluster RBAC bypass in /api/v1/overview | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-08-21T21:35:41.451Z
Reserved: 2026-06-09T17:05:25.058Z
Link: CVE-2026-53487
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-21T22:16:38.710
Modified: 2026-08-21T22:16:38.710
Link: CVE-2026-53487
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-21T22:30:17Z