GHSA-c534-2w9c-x7fm: Github.com/zxh326/kite Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c534-2w9c-x7fm",
  "modified" : "2026-07-24T21:47:17Z",
  "published" : "2026-07-24T21:47:16Z",
  "aliases" : [ ],
  "summary" : "Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources",
  "details" : "## Summary\n\nKite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.\n\n## Impact\n\nAn authenticated user with `get` permission on pods or services in one namespace can cause Kite to issue GET requests to Kubernetes API endpoints outside that namespace using Kite's service account.\n\nWith Kite's default Helm RBAC configuration, this allows cluster-wide resource disclosure, including Secrets. The validated impact is confidentiality only; resource modification and denial of service were not demonstrated.\n\nDeployments using a restricted Kite service account are affected only up to the permissions granted to that service account.\n\n## Technical details\n\nThe authorization check is performed against the original namespace and kind route parameters. The proxy path is subsequently decoded and passed to `url.JoinPath`, which resolves `..` segments and can produce an upstream URL outside the authorized pod or service proxy prefix.\n\nTwo input locations were affected:\n\n1. Encoded traversal segments in the proxy catch-all path.\n2. Encoded traversal and slash characters in the resource name.\n\n## Reproduction\n\n\n1. Create a user with a role granting only `pods:get` in namespace `default`.\n2. Create any pod in `default` (e.g. `nginx`).\n3. Send the following request (auth cookie required):\n\n```bash\ncurl --path-as-is --cookie \"auth_token=<JWT>\" \\\n  'http://<kite-host>/api/v1/_clusters/<cluster>/namespaces/default/pods/nginx/proxy/%2e%2e/%2e%2e/%2e%2e/%2e%2e/kube-system/secrets'\n```\n\n## Patches\n\nFixed in Kite 0.14.1.\n\n- https://github.com/kite-org/kite/releases/tag/v0.14.1\n\n## Workarounds\n\nUpgrade to 0.14.1 or later.\n\nIf upgrading is temporarily impossible, reject encoded dot segments and encoded slashes at the reverse proxy and restrict Kite's Kubernetes service account permissions. Reverse-proxy normalization should not be treated as a permanent fix.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/zxh326/kite"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.6.9"
      }, {
        "fixed" : "0.14.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.14.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/kite-org/kite/security/advisories/GHSA-c534-2w9c-x7fm"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kite-org/kite/pull/638"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kite-org/kite/commit/08116eed557f8d6982cc83af0b02991e0f3577d5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kite-org/kite/commit/69ad938937af8f375a2e183d1a331926ab851d98"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/kite-org/kite"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/kite-org/kite/releases/tag/v0.14.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-647" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T21:47:16Z",
    "nvd_published_at" : null
  }
}