Read the docs
TI-2026-38566 Aliases CVE-2026-53487GHSA-gvhc-wv3v-7pf8

Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Priority MEDIUM 53CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed kite (kite-org): 0.12.3github.com/zxh326/kite (Go): 0.12.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kite-orgkitebefore 0.12.30.12.3Patch availableCNA
—github.com/zxh326/kite (Go)before 0.12.30.12.3Patch availableGHSA-gvhc-wv3v-7pf8
  • kite Vendorkite-org Affected before 0.12.3 Fixed in 0.12.3 Patch available CNA
  • github.com/zxh326/kite (Go) Vendor— Affected before 0.12.3 Fixed in 0.12.3 Patch available GHSA-gvhc-wv3v-7pf8

Remediation

  • Fix · CNA kite (kite-org) Fixed in 0.12.3
  • Fix · GHSA-gvhc-wv3v-7pf8 github.com/zxh326/kite (Go) Fixed in 0.12.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53487
  2. 2026-10-03 Alias added: GHSA-gvhc-wv3v-7pf8

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences