CyberRota Analysis
AI-GeneratedAuthenticated users in Kite, a Kubernetes dashboard, can exploit a flaw to access the `/api/v1/overview` endpoint for clusters they are not authorized to view by manipulating the `x-cluster-name` header. This vulnerability allows unauthorized access to sensitive inventory and capacity data from restricted clusters, potentially leading to data exposure. Organizations using Kite prior to version 0.12.3 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.