
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-53487 is an authenticated cluster RBAC bypass vulnerability in Kite, a Kubernetes management dashboard, affecting all versions up to and including v0.12.2. Any authenticated Kite user with at least one role can query the /api/v1/overview endpoint for clusters they are not authorized to access by supplying an arbitrary cluster name via the x-cluster-name header. The vulnerability was discovered and reported by researcher DavidCarliez, first published May 31, 2026, and added to the GitHub Advisory Database on July 7, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Kite Advisory).
The root cause is a missing authorization check (CWE-862) caused by a route registration ordering error in routes.go. The /api/v1/overview route is registered at line 135 before the global middleware.RBACMiddleware() is applied at line 171, meaning the RBAC middleware never executes for this endpoint. The ClusterMiddleware in pkg/middleware/cluster.go accepts the target cluster name from the x-cluster-name header, query parameter, or cookie and injects the corresponding ClientSet without verifying whether the requesting user has permission to access that cluster. The GetOverview handler in pkg/system/handler.go only checks len(user.Roles) > 0 — rejecting users with zero roles — but does not call rbac.CanAccessCluster(user, cs.Name), which is the check correctly used by other endpoints such as /api/v1/clusters (GitHub Advisory, Kite Advisory).
The impact is limited to confidentiality. A low-privileged authenticated user can retrieve aggregate Kubernetes inventory and resource sizing data — including total node count, pod count, namespace count, service count, and CPU/memory allocations — from any cluster configured in the Kite instance, regardless of their assigned cluster permissions. The advisory explicitly confirms that Kubernetes mutation, individual pod names, secret values, kubeconfig contents, and bearer tokens are not exposed through this endpoint, limiting the risk to information disclosure of cluster capacity metadata (GitHub Advisory).
GET /api/v1/overview HTTP request to the Kite API, including the standard authentication token/session cookie and the x-cluster-name: <target-cluster> header set to the unauthorized cluster name.totalNodes, totalPods, totalNamespaces, totalServices, and CPU/memory resource values.Example request:
GET /api/v1/overview HTTP/1.1
Host: <kite-instance>
Authorization: Bearer <token>
x-cluster-name: prod-clusterExample unauthorized response:
{"totalNodes":1,"readyNodes":0,"totalPods":1,"runningPods":0,"totalNamespaces":1,"totalServices":1,"prometheusEnabled":false,"resource":{"cpu":{"allocatable":0,"requested":0,"limited":0},"memory":{"allocatable":0,"requested":0,"limited":0}}}GET /api/v1/overview requests from a single authenticated user session, particularly with varying x-cluster-name header values that differ from the clusters the user is authorized to access./api/v1/overview for cluster names that do not match the requesting user's assigned roles or cluster permissions.Upgrade to Kite version 0.12.3, which is the patched release addressing this vulnerability. The fix should include adding an explicit rbac.CanAccessCluster(user, cs.Name) check in the GetOverview handler before any cluster data is queried, and/or moving the /api/v1/overview route registration to after api.Use(middleware.RBACMiddleware()) in routes.go. As a temporary workaround where upgrading is not immediately possible, restrict Kite access to trusted users only and monitor API logs for cross-cluster overview requests (GitHub Advisory, Kite Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."