GHSA-22vc-5pgw-644q
KubeView vulnerable to full cluster takeover due to improper authentication
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/benc-uk/kubeview | <= 0.1.31 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side project and a learning exercise," and not "very secure."
References
External links from the advisory. They lead to third-party sites.