Loading vulnerability…
Authentication Bypass in Kubernetes Dashboard
Kubernetes Dashboard versions before 1.10.1 contain an authentication bypass vulnerability that allows attackers to access cluster resources using the Dashboard's Service Account. An unauthenticated attacker can exploit this behavior to read Kubernetes Secrets where the Service Account has the necessary permissions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation exposes Kubernetes Secrets accessible to the Dashboard's Service Account. Depending on their contents, disclosed secrets may include credentials, tokens, or other sensitive application data that could enable additional unauthorized access. The scope of disclosure depends on the Service Account's effective permissions.
If you can’t patch tonight, do this now.
Restrict network access to Kubernetes Dashboard to trusted administrative users and networks. Apply least-privilege RBAC permissions to the Dashboard's Service Account, removing unnecessary access to Secrets. These controls reduce exposure and potential disclosure but do not replace upgrading.
Patch, then assume compromise.
Upgrade Kubernetes Dashboard to version 1.10.1 or later, which addresses the authentication bypass.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.