PT-2025-43651 · Unknown · Karmada Dashboard

Published 2025-10-24 · Updated 2025-11-07 · CVE-2025-62714

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Karmada Dashboard versions prior to 0.2.0

Description The Karmada Dashboard, a web-based control panel for the Karmada multi-cluster management project, contains an authentication bypass. Backend API endpoints, such as /api/v1/secret and /api/v1/service, do not enforce authentication. This allows unauthenticated users to access sensitive cluster information, including Secrets and Services, directly. While the web user interface requires a valid JWT for access, the API remains exposed to direct requests without authentication checks. Any user or entity with network access to the Karmada Dashboard service could potentially retrieve sensitive data through these exposed API endpoints. The vulnerable parameters are not explicitly mentioned.

Recommendations Versions prior to 0.2.0 should be updated to version 0.2.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-62714

GHSA-5QJG-9MJH-4R92

GO-2025-4072

OPENSUSE-SU-2025:15710-1

Affected Products

Karmada Dashboard

References · 92

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62714.json · Exploit
• https://osv.dev/vulnerability/GO-2025-4072 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5qjg-9mjh-4r92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62714 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62714 · Security Note
• https://github.com/karmada-io/dashboard/pull/280 · Note
• https://github.com/karmada-io/dashboard/pull/271 · Note
• https://github.com/karmada-io/dashboard/security/advisories/GHSA-5qjg-9mjh-4r92 · Note
• https://github.com/karmada-io/dashboard/releases/tag/v0.2.0 · Note
• https://github.com/karmada-io/dashboard/commit/8457b8bb87725e2371a638ca5a255fd2895c70f1 · Note
• https://github.com/karmada-io/dashboard/commit/d2d04909f25e96b4c20fa6b636c398bd1636ee06 · Note
• https://github.com/karmada-io/dashboard · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note