CVE-2025-62714: Karmada Dashboard authentication bypass in backend API

Executive brief

Karmada Dashboard is a management interface for Kubernetes cluster federation. A security flaw in its backend API allowed anyone with network access to bypass authentication and view sensitive information, such as cluster secrets and service configurations. This could lead to full cluster compromise or unauthorized data access.

Technical details

An authentication bypass vulnerability exists in the Karmada Dashboard API due to missing authorization checks (CWE-862) on backend endpoints. While the web UI enforced JWT-based authentication, the underlying API endpoints (e.g., /api/v1/secret, /api/v1/service) remained exposed to direct, unauthenticated requests. A remote attacker with network access to the dashboard service could exploit this to retrieve sensitive cluster information. The issue is resolved in version 0.2.0 by enforcing authentication across all API endpoints.

Affected products

• Karmada Dashboard < 0.2.0

Timeline

• 2025-10-24: disclosed
• 2025-10-24: advisory
• 2025-10-24: patched: Fixed in version 0.2.0

References

• https://api.github.com/users/warjiang
• https://github.com/warjiang
• https://api.github.com/users/warjiang/gists%7B/gist_id%7D
• https://api.github.com/users/warjiang/repos
• https://avatars.githubusercontent.com/u/6478745?v=4
• https://api.github.com/users/warjiang/events%7B/privacy%7D