Karmada-io vulnerabilities
We track 3 vulnerabilities in Karmada-io products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2025.
Latest Karmada-io vulnerabilities
- 8.7 High severity
dashboard: Missing Authorization
Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints (e.g., /api
- 8.7 High severity
karmada: Incorrect Privilege Assignment
Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the `karmadactl register` command have excessive privil
- 8.4 High severity
karmada: Improper Access Control
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does no