CVE-2026-44514 Details

A Cross-Site WebSocket Hijacking vulnerability has been identified in Kubetail, a real-time logging dashboard for Kubernetes, affecting versions prior to 0.14.0. The issue arises because the dashboard's WebSocket endpoints did not properly validate the Origin header during connection upgrades. This flaw allows a malicious web page to open a WebSocket connection to the dashboard of a user with an active Kubetail session, enabling the attacker to read Kubernetes logs in real time. The vulnerability impacts both the desktop deployment, which defaults to 'localhost:7500', and cluster deployments typically behind an Ingress with HTTP basic authentication.

Users can upgrade to Kubetail Dashboard version 0.14.0 or later, Kubetail Helm Chart version 0.23.0 or later, or Kubetail CLI version 0.16.0 or later. If an immediate upgrade is not possible, desktop users should stop the dashboard when not in use and avoid visiting untrusted sites in the same browser profile. For cluster deployments, access should be restricted to a VPN, bastion, or office network, and a stronger authentication layer added in front of basic auth.