Threats affecting pkg:github/karmada-io/dashboard

Karmada Dashboard versions prior to 0.2.0 contain an authentication bypass vulnerability in their backend API endpoints. These endpoints do not enforce authentication, allowing unauthenticated users with network access to retrieve sensitive cluster information such as Secrets and Services. The web UI requires JWT authentication, but the API itself is exposed without checks. This vulnerability is identified as CWE-862 and has a high severity score of 8.7.