Medium severity4.3NVD Advisory· Published Aug 21, 2026· Updated Sep 9, 2026
CVE-2026-53487
CVE-2026-53487
Description
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware() and GetOverview only checks len(user.Roles) > 0, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/zxh326/kiteGo | < 0.12.3 | 0.12.3 |
Affected products
2- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.