CVE-2025-62714

Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data.

CVSS

No CVSS.

References

Link	Resource
https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1
https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06
https://github.com/karmada-io/dashboard/pull/271
https://github.com/karmada-io/dashboard/pull/280
https://github.com/karmada-io/dashboard/releases/tag/v0.2.0
https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Karmada Dashboard es un panel de control de propósito general, basado en web, para Karmada, que es un proyecto de gestión multi-clúster. Antes de la versión 0.2.0, existe una vulnerabilidad de omisión de autenticación en la API de Karmada Dashboard. Los endpoints de la API de backend (por ejemplo, /api/v1/secret, /api/v1/service) no aplicaban autenticación, permitiendo a usuarios no autenticados acceder directamente a información sensible del clúster como Secrets y Services. Aunque la interfaz de usuario web requería un JWT válido para el acceso, la propia API permanecía expuesta a solicitudes directas sin ninguna verificación de autenticación. Cualquier usuario o entidad con acceso de red al servicio de Karmada Dashboard podría explotar esta vulnerabilidad para recuperar datos sensibles.

Information

Published : 2025-10-24 16:28

Updated : 2026-10-08 11:10

NVD link : CVE-2025-62714

Mitre link : CVE-2025-62714

CVE.ORG link : CVE-2025-62714

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-62714", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62714", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-24T17:29:25.879674Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "karmada-io", "product": "dashboard", "versions": [{"status": "affected", "version": "< 0.2.0"}]}]}], "published": "2025-10-24T16:28:01.980", "references": [{"url": "https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1", "source": "security-advisories@github.com"}, {"url": "https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06", "source": "security-advisories@github.com"}, {"url": "https://github.com/karmada-io/dashboard/pull/271", "source": "security-advisories@github.com"}, {"url": "https://github.com/karmada-io/dashboard/pull/280", "source": "security-advisories@github.com"}, {"url": "https://github.com/karmada-io/dashboard/releases/tag/v0.2.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api/v1/secret, /api/v1/service) did not enforce authentication, allowing unauthenticated users to access sensitive cluster information such as Secrets and Services directly. Although the web UI required a valid JWT for access, the API itself remained exposed to direct requests without any authentication checks. Any user or entity with network access to the Karmada Dashboard service could exploit this vulnerability to retrieve sensitive data."}, {"lang": "es", "value": "Karmada Dashboard es un panel de control de prop\u00f3sito general, basado en web, para Karmada, que es un proyecto de gesti\u00f3n multi-cl\u00faster. Antes de la versi\u00f3n 0.2.0, existe una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la API de Karmada Dashboard. Los endpoints de la API de backend (por ejemplo, /api/v1/secret, /api/v1/service) no aplicaban autenticaci\u00f3n, permitiendo a usuarios no autenticados acceder directamente a informaci\u00f3n sensible del cl\u00faster como Secrets y Services. Aunque la interfaz de usuario web requer\u00eda un JWT v\u00e1lido para el acceso, la propia API permanec\u00eda expuesta a solicitudes directas sin ninguna verificaci\u00f3n de autenticaci\u00f3n. Cualquier usuario o entidad con acceso de red al servicio de Karmada Dashboard podr\u00eda explotar esta vulnerabilidad para recuperar datos sensibles."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "security-advisories@github.com"}