CVE-2026-53487

Name of the Vulnerable Software and Affected Versions Kite versions prior to v0.12.3

Description Authenticated users can bypass cluster-based Role-Based Access Control (RBAC) to retrieve aggregate inventory and capacity data from clusters they are not authorized to access. This occurs because the /api/v1/overview endpoint is registered before the global RBAC middleware is applied, and the GetOverview function only verifies if a user has at least one role, rather than checking if they have permission to access the specific requested cluster. An attacker can specify a target cluster using the x-cluster-name header to obtain total counts of nodes, pods, namespaces, services, CPU, and memory.

Recommendations Update Kite to a version later than v0.12.2. Implement an explicit authorization check using rbac.CanAccessCluster(user, cs.Name) before querying overview data. Move all routes that lack independent authorization below the middleware.RBACMiddleware() registration in routes.go.