Kubetail, a real-time logging dashboard for Kubernetes, had a security flaw before version 0.14.0 where its WebSocket endpoints did not adequately validate the Origin header during connection upgrades. This missing origin validation (CWE-1385) enables a Cross-Site WebSocket Hijacking attack, allowing a malicious web page to connect to an active Kubetail dashboard session and read Kubernetes logs in real time. Both local desktop deployments and cluster deployments behind HTTP basic auth are affected. The vulnerability is addressed and fixed in Kubetail version 0.14.0.

An attacker can exploit this vulnerability by tricking a user with an active Kubetail session into visiting a malicious web page, which then opens a WebSocket connection to the Kubetail dashboard and reads sensitive Kubernetes logs in real time. This compromises confidentiality of log data but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

Upgrade Kubetail to version 0.14.0 or later, where this vulnerability is fixed by proper Origin header validation on WebSocket connections. No other mitigation is required as the fix is available and addresses the issue directly.