Vulnerability-Lookup

CVE-2026-53487 (GCVE-0-2026-53487)

Vulnerability from cvelistv5 – Published: 2026-08-21 21:35 – Updated: 2026-08-25 16:47

Title

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Summary

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-25 16:46 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/kite-org/kite/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
kite-org	kite	Affected: < 0.12.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53487",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:46:29.822470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T16:47:05.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kite",
          "vendor": "kite-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:35:41.451Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
        }
      ],
      "source": {
        "advisory": "GHSA-gvhc-wv3v-7pf8",
        "discovery": "UNKNOWN"
      },
      "title": "Kite has an authenticated cluster RBAC bypass in /api/v1/overview"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53487",
    "datePublished": "2026-08-21T21:35:41.451Z",
    "dateReserved": "2026-06-09T17:05:25.058Z",
    "dateUpdated": "2026-08-25T16:47:05.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53487",
      "date": "2026-10-24",
      "epss": "0.0027",
      "percentile": "0.18277"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kite",
                "vendor": "kite-org",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.12.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue."
          },
          {
            "lang": "es",
            "value": "Kite es un panel de control de Kubernetes. Antes de la versi\u00f3n 0.12.3, los usuarios autenticados de Kite con cualquier rol pueden solicitar \u0027/API/v1/overview\u0027 para un cl\u00faster que sus roles no permiten, seleccionando ese cl\u00faster con \u0027x-cluster-name\u0027. La ruta de la vista general se registra antes de \u0027middleware.RBACMiddleware()\u0027 y \u0027GetOverview\u0027 solo verifica \u0027len(user.Roles) \u003e 0\u0027, por lo que devuelve datos agregados de inventario y capacidad de Kubernetes de cl\u00fasteres no autorizados. La versi\u00f3n 0.12.3 soluciona el problema."
          }
        ],
        "id": "CVE-2026-53487",
        "lastModified": "2026-10-12T16:10:00.220",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53487",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:46:29.822470Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-21T22:16:38.710",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53487",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-25T16:46:29.822470Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-25T16:46:43.608Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "kite",
              "vendor": "kite-org",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.12.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T21:35:41.451Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
            }
          ],
          "source": {
            "advisory": "GHSA-gvhc-wv3v-7pf8",
            "discovery": "UNKNOWN"
          },
          "title": "Kite has an authenticated cluster RBAC bypass in /api/v1/overview"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53487",
        "datePublished": "2026-08-21T21:35:41.451Z",
        "dateReserved": "2026-06-09T17:05:25.058Z",
        "dateUpdated": "2026-08-25T16:47:05.989Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53487

Vulnerability from fkie_nvd - Published: 2026-08-21 22:16 - Updated: 2026-10-12 16:10

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kite",
          "vendor": "kite-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.12.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Kite es un panel de control de Kubernetes. Antes de la versi\u00f3n 0.12.3, los usuarios autenticados de Kite con cualquier rol pueden solicitar \u0027/API/v1/overview\u0027 para un cl\u00faster que sus roles no permiten, seleccionando ese cl\u00faster con \u0027x-cluster-name\u0027. La ruta de la vista general se registra antes de \u0027middleware.RBACMiddleware()\u0027 y \u0027GetOverview\u0027 solo verifica \u0027len(user.Roles) \u003e 0\u0027, por lo que devuelve datos agregados de inventario y capacidad de Kubernetes de cl\u00fasteres no autorizados. La versi\u00f3n 0.12.3 soluciona el problema."
    }
  ],
  "id": "CVE-2026-53487",
  "lastModified": "2026-10-12T16:10:00.220",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53487",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T16:46:29.822470Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T22:16:38.710",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GVHC-WV3V-7PF8

Vulnerability from github – Published: 2026-07-07 23:40 – Updated: 2026-07-07 23:40

Summary

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Details

Summary

Authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware() and GetOverview only checks len(user.Roles) > 0, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters.

The issue is present on current main commit 38c9bb9d4b746c0d2a8252f3c35cdfa07ab01c21 and latest release v0.12.2 at commit 0aae35abb2d6a8adf623fe60349261aa48753ccc.

Impact

A low-privileged user who only has access to one cluster can set x-cluster-name to another configured cluster and retrieve aggregate inventory and resource sizing data for that cluster. The response includes total node, pod, namespace, service, CPU, and memory values. This bypasses the cluster membership boundary used elsewhere in Kite.

The validated impact is confidentiality only. I did not prove Kubernetes mutation, pod names, secret values, kubeconfig contents, or bearer token exposure through this endpoint.

Technical details

routes.go registers /api/v1/overview before the global RBAC middleware is applied:

routes.go:131-133: /api/v1 gets RequireAuth() and ClusterMiddleware(cm).
routes.go:135: /api/v1/overview is registered.
routes.go:171: api.Use(middleware.RBACMiddleware()) is applied only after overview and several other routes are registered.

pkg/middleware/cluster.go:21-40 accepts the target cluster name from x-cluster-name, query, or cookie and injects the matching ClientSet without checking whether the user can access that cluster.

pkg/system/handler.go:47-52 retrieves the selected cluster and user, but only rejects users with zero roles:

cs := c.MustGet("cluster").(*cluster.ClientSet)
user := c.MustGet("user").(model.User)
if len(user.Roles) == 0 {
    c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
    return
}

It then lists nodes, pods, namespaces, and services for the selected cluster at pkg/system/handler.go:63-137 and returns aggregate data at pkg/system/handler.go:147-169.

The intended cluster boundary exists elsewhere. pkg/cluster/cluster_handler.go:19-47 filters /api/v1/clusters with rbac.CanAccessCluster(user, name), and pkg/rbac/rbac.go:32-40 implements that cluster check. The vulnerable overview path skips the same check.

Reproduction

Configure Kite with at least two clusters, for example dev-cluster and prod-cluster.
Create a user with a role that allows only dev-cluster and does not match prod-cluster.
Authenticate as that user.
Send GET /api/v1/overview with header x-cluster-name: prod-cluster.
Observe that the response includes aggregate inventory and capacity data for prod-cluster instead of returning 403.

I also validated this locally with a Go proof test. The test constructs a fake prod-cluster containing one node, namespace, service, and pod. The user has a role limited to dev-cluster and dev-ns only. Before calling the handler, both controls return false:

rbac.CanAccess(user, "pods", "get", "prod-cluster", "_all")
rbac.CanAccessCluster(user, "prod-cluster")

The direct handler call then succeeds and returns the unauthorized production cluster aggregate data.

Command run:

cd /home/unkn0wn/security_audit/kite
go test ./pkg/system -run TestOverviewAllowsUserWithoutTargetClusterRBAC -v

Key output:

=== RUN   TestOverviewAllowsUserWithoutTargetClusterRBAC
    overview_rbac_poc_test.go:74: unauthorized overview response: {"totalNodes":1,"readyNodes":0,"totalPods":1,"runningPods":0,"totalNamespaces":1,"totalServices":1,"prometheusEnabled":false,"resource":{"cpu":{"allocatable":0,"requested":0,"limited":0},"memory":{"allocatable":0,"requested":0,"limited":0}}}
--- PASS: TestOverviewAllowsUserWithoutTargetClusterRBAC (0.49s)
PASS
ok      github.com/zxh326/kite/pkg/system   0.711s

Suggested remediation

Add an explicit cluster and resource authorization check before any overview data is queried. At minimum, reject users without rbac.CanAccessCluster(user, cs.Name). A stricter fix should require the same resource permissions used by the AI get_cluster_overview tool:

get nodes at cluster scope
get pods across all namespaces
get namespaces at cluster scope
get services across all namespaces

Also consider moving every route that lacks its own complete authorization below api.Use(middleware.RBACMiddleware()), or adding per-handler authorization tests for all pre-RBAC routes.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.12.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zxh326/kite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53487"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T23:40:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAuthenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) \u003e 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters.\n\nThe issue is present on current main commit `38c9bb9d4b746c0d2a8252f3c35cdfa07ab01c21` and latest release `v0.12.2` at commit `0aae35abb2d6a8adf623fe60349261aa48753ccc`.\n\n## Impact\n\nA low-privileged user who only has access to one cluster can set `x-cluster-name` to another configured cluster and retrieve aggregate inventory and resource sizing data for that cluster. The response includes total node, pod, namespace, service, CPU, and memory values. This bypasses the cluster membership boundary used elsewhere in Kite.\n\nThe validated impact is confidentiality only. I did not prove Kubernetes mutation, pod names, secret values, kubeconfig contents, or bearer token exposure through this endpoint.\n\n## Technical details\n\n`routes.go` registers `/api/v1/overview` before the global RBAC middleware is applied:\n\n- `routes.go:131-133`: `/api/v1` gets `RequireAuth()` and `ClusterMiddleware(cm)`.\n- `routes.go:135`: `/api/v1/overview` is registered.\n- `routes.go:171`: `api.Use(middleware.RBACMiddleware())` is applied only after overview and several other routes are registered.\n\n`pkg/middleware/cluster.go:21-40` accepts the target cluster name from `x-cluster-name`, query, or cookie and injects the matching `ClientSet` without checking whether the user can access that cluster.\n\n`pkg/system/handler.go:47-52` retrieves the selected cluster and user, but only rejects users with zero roles:\n\n```go\ncs := c.MustGet(\"cluster\").(*cluster.ClientSet)\nuser := c.MustGet(\"user\").(model.User)\nif len(user.Roles) == 0 {\n    c.JSON(http.StatusForbidden, gin.H{\"error\": \"Access denied\"})\n    return\n}\n```\n\nIt then lists nodes, pods, namespaces, and services for the selected cluster at `pkg/system/handler.go:63-137` and returns aggregate data at `pkg/system/handler.go:147-169`.\n\nThe intended cluster boundary exists elsewhere. `pkg/cluster/cluster_handler.go:19-47` filters `/api/v1/clusters` with `rbac.CanAccessCluster(user, name)`, and `pkg/rbac/rbac.go:32-40` implements that cluster check. The vulnerable overview path skips the same check.\n\n## Reproduction\n\n1. Configure Kite with at least two clusters, for example `dev-cluster` and `prod-cluster`.\n2. Create a user with a role that allows only `dev-cluster` and does not match `prod-cluster`.\n3. Authenticate as that user.\n4. Send `GET /api/v1/overview` with header `x-cluster-name: prod-cluster`.\n5. Observe that the response includes aggregate inventory and capacity data for `prod-cluster` instead of returning 403.\n\nI also validated this locally with a Go proof test. The test constructs a fake `prod-cluster` containing one node, namespace, service, and pod. The user has a role limited to `dev-cluster` and `dev-ns` only. Before calling the handler, both controls return false:\n\n- `rbac.CanAccess(user, \"pods\", \"get\", \"prod-cluster\", \"_all\")`\n- `rbac.CanAccessCluster(user, \"prod-cluster\")`\n\nThe direct handler call then succeeds and returns the unauthorized production cluster aggregate data.\n\nCommand run:\n\n```bash\ncd /home/unkn0wn/security_audit/kite\ngo test ./pkg/system -run TestOverviewAllowsUserWithoutTargetClusterRBAC -v\n```\n\nKey output:\n\n```text\n=== RUN   TestOverviewAllowsUserWithoutTargetClusterRBAC\n    overview_rbac_poc_test.go:74: unauthorized overview response: {\"totalNodes\":1,\"readyNodes\":0,\"totalPods\":1,\"runningPods\":0,\"totalNamespaces\":1,\"totalServices\":1,\"prometheusEnabled\":false,\"resource\":{\"cpu\":{\"allocatable\":0,\"requested\":0,\"limited\":0},\"memory\":{\"allocatable\":0,\"requested\":0,\"limited\":0}}}\n--- PASS: TestOverviewAllowsUserWithoutTargetClusterRBAC (0.49s)\nPASS\nok  \tgithub.com/zxh326/kite/pkg/system\t0.711s\n```\n\n## Suggested remediation\n\nAdd an explicit cluster and resource authorization check before any overview data is queried. At minimum, reject users without `rbac.CanAccessCluster(user, cs.Name)`. A stricter fix should require the same resource permissions used by the AI `get_cluster_overview` tool:\n\n- `get nodes` at cluster scope\n- `get pods` across all namespaces\n- `get namespaces` at cluster scope\n- `get services` across all namespaces\n\nAlso consider moving every route that lacks its own complete authorization below `api.Use(middleware.RBACMiddleware())`, or adding per-handler authorization tests for all pre-RBAC routes.",
  "id": "GHSA-gvhc-wv3v-7pf8",
  "modified": "2026-07-07T23:40:35Z",
  "published": "2026-07-07T23:40:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kite-org/kite"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kite has an authenticated cluster RBAC bypass in /api/v1/overview"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53487 (GCVE-0-2026-53487)

FKIE_CVE-2026-53487

GHSA-GVHC-WV3V-7PF8

Summary

Impact

Technical details

Reproduction

Suggested remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour