Kite's Kubernetes proxy authorization checks are performed against the original namespace and resource kind parameters, but the proxy path is later decoded and normalized, allowing encoded path traversal sequences (e.g., %2e%2e) to redirect requests to unauthorized Kubernetes API endpoints. Authenticated users with 'get' permission on pods or services in one namespace can exploit this to read resources in other namespaces, including cluster-wide Secrets, using Kite's service account. The vulnerability affects Kite versions from 0.6.9 up to but not including 0.14.1. The impact is limited to confidentiality breaches; no resource modification or denial of service has been demonstrated. The issue was fixed in Kite 0.14.1.

An authenticated user with limited 'get' permissions in a single namespace can leverage this vulnerability to access Kubernetes API endpoints outside their authorized namespace, potentially disclosing sensitive cluster-wide resources such as Secrets. The impact is confidentiality loss only; integrity and availability are not affected. The extent of exposure depends on the permissions granted to Kite's Kubernetes service account. Deployments with restricted service accounts are limited to those permissions.

Upgrade Kite to version 0.14.1 or later, where this vulnerability is fixed. If immediate upgrade is not possible, implement reverse proxy rules to reject encoded dot segments (%2e%2e) and encoded slashes in requests to Kite. Additionally, restrict the permissions of Kite's Kubernetes service account to minimize potential exposure. Note that reverse proxy normalization is a temporary workaround and should not be considered a permanent fix.