Read the docs
TI-2026-32444 Aliases CVE-2026-44514GHSA-v8j7-hp7c-738f

Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users

Priority LOW 28CWE-1385Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. This is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability and affects both the desktop deployment (default http://localhost:7500) and cluster deployments (typically behind an Ingress with HTTP basic auth). This vulnerability is fixed in 0.14.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed kubetail (kubetail-org): 0.14.0github.com/kubetail-org/kubetail/modules/cli (kubetail-org): 0.16.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kubetail-orgkubetailbefore 0.14.00.14.0Patch availableCNA
kubetail-orggithub.com/kubetail-org/kubetail/modules/clibefore 0.16.00.16.0Patch availableCNA
kubetail-orggithub.com/kubetail-org/kubetail/modules/dashboardbefore 0.14.00.14.0Patch availableCNA
—github.com/kubetail-org/kubetail/modules/dashboard (Go)before 0.14.00.14.0Patch availableGHSA-v8j7-hp7c-738f
—github.com/kubetail-org/kubetail/modules/cli (Go)before 0.16.00.16.0Patch availableGHSA-v8j7-hp7c-738f
  • kubetail Vendorkubetail-org Affected before 0.14.0 Fixed in 0.14.0 Patch available CNA
  • github.com/kubetail-org/kubetail/modules/cli Vendorkubetail-org Affected before 0.16.0 Fixed in 0.16.0 Patch available CNA
  • github.com/kubetail-org/kubetail/modules/dashboard Vendorkubetail-org Affected before 0.14.0 Fixed in 0.14.0 Patch available CNA
  • github.com/kubetail-org/kubetail/modules/dashboard (Go) Vendor— Affected before 0.14.0 Fixed in 0.14.0 Patch available GHSA-v8j7-hp7c-738f
  • github.com/kubetail-org/kubetail/modules/cli (Go) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-v8j7-hp7c-738f

Remediation

  • Fix · CNA kubetail (kubetail-org) Fixed in 0.14.0
  • Fix · CNA github.com/kubetail-org/kubetail/modules/cli (kubetail-org) Fixed in 0.16.0
  • Fix · CNA github.com/kubetail-org/kubetail/modules/dashboard (kubetail-org) Fixed in 0.14.0
  • Fix · GHSA-v8j7-hp7c-738f github.com/kubetail-org/kubetail/modules/dashboard (Go) Fixed in 0.14.0 Advisory →
  • Fix · GHSA-v8j7-hp7c-738f github.com/kubetail-org/kubetail/modules/cli (Go) Fixed in 0.16.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44514
  2. 2026-10-03 Alias added: GHSA-v8j7-hp7c-738f

References

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences