Executive brief
ThermaKube is an open-source web application used to monitor the health and performance of Kubernetes clusters, including AWS EKS deployments. A security vulnerability was identified where the application uses hard-coded credentials and fails to properly validate security certificates. This could allow an attacker to gain unauthorized access to the monitoring dashboard or intercept sensitive data transmitted between the application and the Kubernetes infrastructure.
Technical details
The ThermaKube master branch is affected by two primary security weaknesses: the use of a hard-coded password (CWE-259) and improper certificate validation (CWE-295). Specifically, the application disables TLS/SSL certificate validation by setting 'rejectUnauthorized: false' in API request options. This combination of flaws allows a remote, unauthenticated attacker to bypass authentication or perform man-in-the-middle (MITM) attacks to intercept sensitive cluster data. The vulnerability is reachable over the network without user interaction. As of the advisory date, no specific patch version has been released beyond the identified 'master' branch state.
Affected products
- oslabs-beta ThermaKube master branch
Timeline
- 2026-03-09: other: Vulnerability details first shared via GitHub Gist.
- 2026-03-11: disclosed: CVE-2025-70041 published.