{"answers":{"affected":"3 open source packages ship an affected version, including github.com/zxh326/kite.","exploited":"There is no known exploitation of GHSA-c534-2w9c-x7fm in the wild and no public exploit code.","fix":"Upgrade github.com/zxh326/kite to 0.14.1 or later.","what":"GHSA-c534-2w9c-x7fm is a path traversal vulnerability in github.com/zxh326/kite, published on 24 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-c534-2w9c-x7fm and fix it if it is affected.\n\nWhat it is: GHSA-c534-2w9c-x7fm is a path traversal vulnerability in github.com/zxh326/kite, published on 24 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-c534-2w9c-x7fm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/zxh326/kite (Go): affected from 0.6.9; fixed in 0.14.1\n- github.com/zxh326/kite (Go): affected from 0.6.9; fixed in 0.14.1\n- github.com/zxh326/kite (Go): affected from 0.6.9; fixed in 0.14.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-c534-2w9c-x7fm/ (Markdown: https://insights.sbomify.com/GHSA-c534-2w9c-x7fm/index.md)","id":"GHSA-c534-2w9c-x7fm","markdown":"https://insights.sbomify.com/GHSA-c534-2w9c-x7fm/index.md","name":"GHSA-c534-2w9c-x7fm","record":{"aliases":["GO-2026-6105"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes proxy","requires_auth":"low_privilege","summary":"Authenticated users can bypass RBAC via path traversal to read cluster-wide secrets using Kite's service account.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nKite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.\n\n## Impact\n\nAn authenticated user with `get` permission on pods or services in one namespace can cause Kite to issue GET requests to Kubernetes API endpoints outside that namespace using Kite's service account.\n\nWith Kite's default Helm RBAC configuration, this allows cluster-wide resource disclosure, including Secrets. The validated impact is confidentiality only; resource modification and denial of service were not demonstrated.\n\nDeployments using a restricted Kite service account are affected only up to the permissions granted to that service account.\n\n## Technical details\n\nThe authorization check is performed against the original namespace and kind route parameters. The proxy path is subsequently decoded and passed to `url.JoinPath`, which resolves `..` segments and can produce an upstream URL outside the authorized pod or service proxy prefix.\n\nTwo input locations were affected:\n\n1. Encoded traversal segments in the proxy catch-all path.\n2. Encoded traversal and slash characters in the resource name.\n\n## Reproduction\n\n1. Create a user with a role granting only `pods:get` in namespace `default`.\n2. Create any pod in `default` (e.g. `nginx`).\n3. Send the following request (auth cookie required):\n\n```bash\ncurl --path-as-is --cookie \"auth_token=\u003cJWT\u003e\" \\\n  'http://\u003ckite-host\u003e/api/v1/_clusters/\u003ccluster\u003e/namespaces/default/pods/nginx/proxy/%2e%2e/%2e%2e/%2e%2e/%2e%2e/kube-system/secrets'\n```\n\n## Patches\n\nFixed in Kite 0.14.1.\n\n- https://github.com/kite-org/kite/releases/tag/v0.14.1\n\n## Workarounds\n\nUpgrade to 0.14.1 or later.\n\nIf upgrading is temporarily impossible, reject encoded dot segments and encoded slashes at the reverse proxy and restrict Kite's Kubernetes service account permissions. Reverse-proxy normalization should not be treated as a permanent fix.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources","id":"GHSA-c534-2w9c-x7fm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.14.1"],"introduced":["0.6.9"],"last_affected":[],"package":"github.com/zxh326/kite","purl":null,"source":"GHSA-c534-2w9c-x7fm"},{"ecosystem":"Go","fixed":["0.14.1"],"introduced":["0.6.9"],"last_affected":[],"package":"github.com/zxh326/kite","purl":"pkg:golang/github.com/zxh326/kite","source":"GHSA-c534-2w9c-x7fm"},{"ecosystem":"Go","fixed":["0.14.1"],"introduced":["0.6.9"],"last_affected":[],"package":"github.com/zxh326/kite","purl":"pkg:golang/github.com/zxh326/kite","source":"GO-2026-6105"}],"products":null,"published":"2026-07-24","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can bypass RBAC via path traversal to read cluster-wide secrets using Kite's service account.","url":"https://insights.sbomify.com/GHSA-c534-2w9c-x7fm/"}