Threats Tagged 'ghsa-c534-2w9c-x7fm'

Kite versions 0.6.9 through 0.14.0 contain a path traversal vulnerability in the Kubernetes proxy feature that allows authenticated users with limited namespace permissions to bypass RBAC restrictions and read cluster-wide resources. The vulnerability arises because encoded path traversal segments are decoded after authorization checks, enabling access to Kubernetes API endpoints outside the authorized namespace. This can lead to disclosure of sensitive cluster-wide information, including Secrets. The issue is fixed in version 0.14.1.