{"apiVersion":"1.0","identifier":"CVE-2026-53487","description":"Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.","publishedAt":"2026-08-21T22:16:38","lastModifiedAt":"2026-08-25T17:17:29","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53487","cvssScore":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","epssProbability":0.00171,"riskScore":0.44,"affectedProduct":"Kite","affectedVersions":"<0.12.3","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-53487","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-53487","en":"https://www.redsauce.net/en/cves/CVE-2026-53487","fr":"https://www.redsauce.net/fr/cves/CVE-2026-53487","pt":"https://www.redsauce.net/pt/cves/CVE-2026-53487","de":"https://www.redsauce.net/de/cves/CVE-2026-53487","sk":"https://www.redsauce.net/sk/cves/CVE-2026-53487","el":"https://www.redsauce.net/el/cves/CVE-2026-53487"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-53487"}}