6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44514

CVE-2026-44514: Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. This is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability and affects both the desktop deployment (default http://localhost:7500) and cluster deployments (typically behind an Ingress with HTTP basic auth). This vulnerability is fixed in 0.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44514

CVE-2026-44514:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kubetail-org/kubetail/modules/dashboard	go	< 0.14.0	0.14.0
github.com/kubetail-org/kubetail/modules/cli	go	< 0.16.0	0.16.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of Cross-Site WebSocket Hijacking (CSWSH) due to improper validation of the Origin header in WebSocket upgrade requests. The root cause was the httphelpers.IsSameOrigin function, which incorrectly trusted attacker-controllable headers like X-Forwarded-Host and X-Forwarded-Proto. This allowed a malicious website to forge these headers and bypass the same-origin policy, enabling it to establish a WebSocket connection to the victim's Kubetail dashboard and exfiltrate sensitive log data.

The patch addresses this by removing the trust in these headers and relying solely on the r.Host and r.TLS fields of the request. Additionally, a new function, httphelpers.IsAllowedOrigin, was introduced to allow for a configurable list of trusted origins, which is necessary for deployments behind reverse proxies. The vulnerable functions identified are all those that were involved in handling WebSocket connections and used the flawed IsSameOrigin function for origin validation.

Vulnerable functions

httphelpers.IsSameOrigin

modules/shared/httphelpers/httphelpers.go

This function was vulnerable because it trusted attacker-controllable headers (`X-Forwarded-*`) to validate the origin of a WebSocket request. An attacker could forge these headers to make a cross-origin request appear as a same-origin request, thus bypassing security checks and leading to Cross-Site WebSocket Hijacking (CSWSH).

clusterapi.DesktopProxy.ServeHTTP

modules/dashboard/internal/cluster-api/proxy.go

This function handles HTTP requests for the desktop proxy. It was vulnerable because it used the flawed `IsSameOrigin` function to check the origin of WebSocket upgrade requests. This allowed an attacker to establish a malicious WebSocket connection to the user's dashboard.

clusterapi.InClusterProxy.ServeHTTP

modules/dashboard/internal/cluster-api/proxy.go

This function serves the same purpose as `DesktopProxy.ServeHTTP` but for in-cluster deployments. It was also vulnerable due to its reliance on the insecure `IsSameOrigin` function.

graph.NewServer

modules/dashboard/graph/server.go

This function creates a new GraphQL server, including the WebSocket transport. The vulnerability existed in the configuration of the WebSocket upgrader, which used the weak `IsSameOrigin` function for origin validation. This has been patched to use the more secure `IsAllowedOrigin` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.