Medium, CVSS 6.5GoPublished
Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users
CVE-2026-44514 · GHSA-v8j7-hp7c-738f
- Affected
- Go github.com/kubetail-org/kubetail/modules/cli < 0.16.0
- Fixed in
- 0.16.0· Vendor fix available
- Issue
- Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. This is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability and affects both the desktop deployment (default http://localhost:7500) and cluster deployments (typically behind an Ingress with HTTP basic auth). Impact An attacker who can convince an authenticated Kubetail user to visit a page they control can: - Establish a WebSocket connection to the victim's dashboard from the attacker's origin - Stream container logs the victim has access to via the Kubernetes API - Exfiltrate the contents to an attacker-controlled server The attacker gains read-only access to logs — no write or destructive operations are exposed. However, container logs frequently contain credentials accidentally written by…
Recommended action: Upgrade to 0.16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.