Security advisory: Upgrade Kubetail to cli/v0.16.0 and helm/v0.23.0

[amorey]

Hi Everyone,

I wanted to let you know that we've published GHSA-v8j7-hp7c-738f describing a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the Kubetail dashboard. In earlier versions, the dashboard's WebSocket endpoints did not strictly validate the Origin of incoming connections which meant that if you had the dashboard running and visited a page controlled by an attacker while using Google Chrome or Microsoft Edge, that page could open a WebSocket to your dashboard and stream your container logs.

The attacker would only get read access but because container logs often contain things like accidentally-logged tokens, internal hostnames, and user data, we're treating this as a meaningful issue and recommending everyone upgrade immediately.

Both the desktop deployment (kubetail serve) and cluster deployments behind a publicly exposed Ingress are affected.

What you should do

1. If you use the Kubetail CLI, upgrade to 0.16.0 using whichever installer you used originally (e.g. brew upgrade kubetail, kubectl krew upgrade kubetail or see https://www.kubetail.com for other installers)

2. If you run Kubetail in-cluster, upgrade to Helm chart version 0.23.0 (or kubetail-dashboard:0.14.0 docker image in custom deployments).

3. Rotate any credentials that may have been written to your container logs — bearer tokens, API keys, database passwords, etc. We have no evidence of exploitation, but if you're cautious about secret hygiene this is the moment to act on it.

If you can't upgrade right away

1. Desktop: Stop the dashboard when you're not using it. Don't browse untrusted sites with the dashboard running.

2. Cluster: Restrict the dashboard's Ingress to a VPN or trusted network. Add an OAuth proxy in front if you haven't already. This is good practice in general and you should implement this regardless.

What we fixed

The dashboard now enforces a strict Origin check on WebSocket upgrades (only same scheme/domain/port allowed), plus a CSRF token bound to the session that cross-origin JavaScript can't read. Regression tests now cover the disallowed-origin and missing-origin cases. To use Kubetail in-cluster behind a reverse proxy you'll probably have to use the new allowedOrigins option to specifically allow requests from your origin.

How this was found

I found and patched this myself during a security review of the dashboard. We have GitHub's private vulnerability reporting enabled on the repo so future security issues can reach us quickly — if you find something, please use the "Report a vulnerability" button on the Security tab or email hello@kubetail.com.

I sincerely apologize for this vulnerability. I specifically looked for something like this many times before so I'm particularly disappointed in myself for letting it slip by. I'm also angry at Chrome which could do a few simple things to protect their users from WebSocket hijacking and make it easier for devs to build secure real-time services (see #40922285). After everyone has had a chance to upgrade I'll publish some more details and try to get some attention to this issue to make the ecosystem more secure in general.

Andres