CVE-2018-18264: Kubernetes Dashboard authentication bypass exposes cluster secrets

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated network access to cluster secrets with a very high EPSS score and a public exploit reference, though not listed in KEV.

What it is

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and act with the Dashboard's Service Account, reading secrets inside the cluster. Because the Dashboard's Service Account typically holds broad read permissions, an unauthenticated network attacker can reach sensitive cluster data. The flaw is a missing authentication check on a critical function (CWE-306).

Impact

An attacker gains read access to Kubernetes secrets available to the Dashboard Service Account, which can include credentials, tokens and other sensitive configuration. No write or denial-of-service impact is described; the CVSS vector shows confidentiality only.

Attack surface

Reached over the network via the Dashboard's HTTP interface (AV:N, PR:N, UI:N), so no authentication or user interaction is required per the CVSS vector. Any Dashboard instance exposed to an untrusted network is directly at risk.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.70372, 99.35th percentile) and a public exploit write-up is referenced, indicating active interest and practical exploitability.

What to do

• Upgrade Kubernetes Dashboard to 1.10.1 or later, which contains the authentication fix.
• Do not expose the Dashboard to untrusted networks; restrict access to trusted management networks or require an authenticating proxy.
• Review and reduce the RBAC permissions granted to the Dashboard Service Account so it cannot read secrets it does not need.
• Audit cluster secrets for exposure and rotate any credentials that may have been readable through the Dashboard.

Detection

• Review Dashboard access logs for unauthenticated or anomalous requests to secret-related API paths.
• Monitor Kubernetes API audit logs for secret reads performed by the Dashboard Service Account.
• Alert on Dashboard instances reachable from outside trusted networks or without an authentication layer.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.