Executive brief
Kite, a tool for managing Kubernetes clusters, contains a security flaw where an authenticated user can view sensitive summary information about clusters they are not authorized to access. By manipulating a specific request header, a low-privileged user can see aggregate data such as the total number of nodes, pods, and namespaces in other clusters. This could lead to the exposure of infrastructure scale and resource utilization details to unauthorized personnel.
Technical details
A missing authorization check in the `/api/v1/overview` endpoint allows authenticated users to bypass Role-Based Access Control (RBAC) boundaries. The vulnerability exists because the overview route is registered before the global `RBACMiddleware` is applied in `routes.go`. Additionally, the `GetOverview` handler only verifies that a user has at least one role, failing to validate if the user has permissions for the specific cluster requested via the `x-cluster-name` header. An attacker with valid credentials for one cluster can retrieve aggregate data (nodes, pods, namespaces, services, and CPU/memory capacity) for any other configured cluster. The issue is fixed in version 0.12.3.
Affected products
- zxh326 kite <= 0.12.2
Timeline
- 2026-05-31: disclosed: Initial report to vendor
- 2026-07-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Fix released in version 0.12.3