Kubetail, a Kubernetes real-time logging dashboard, exposed WebSocket endpoints that did not properly validate the Origin header before version 0.14.0. This missing validation enables a Cross-Site WebSocket Hijacking attack, where a malicious web page can connect to a user's active Kubetail WebSocket session and access sensitive Kubernetes logs. The vulnerability impacts both local desktop deployments (default at http://localhost:7500) and cluster deployments typically protected by HTTP basic authentication. The vulnerability is tracked as CVE-2026-44514 and is resolved in Kubetail version 0.14.0.

An attacker can exploit this vulnerability to read Kubernetes logs in real time from a user's active Kubetail session by leveraging a malicious web page. This compromises the confidentiality of potentially sensitive log data. The vulnerability does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Upgrade Kubetail to version 0.14.0 or later, where the missing Origin header validation on WebSocket endpoints has been fixed. No other mitigations are indicated or necessary once the upgrade is applied.