Kuboard's platform roles and Kubernetes RBAC are independent, creating access risks

Kuboard is a multi-cluster Kubernetes management platform that stores cluster connections, users, roles, access keys, and OIDC settings, so a compromise could expose both its admin plane and the underlying cluster credentials. Public ZoomEye counts showed thousands of Kuboard-related matches, but these figures do not confirm exposure or whether authentication is enforced. According to Kuboard's documentation, its platform-level scopes and Kubernetes RBAC permissions are separate, so a user may see an object in the UI while the cluster API denies it, or the reverse. The article recommends reviewing both layers, limiting who can add clusters, avoiding cluster-admin kubeconfigs, enforcing MFA, rotating or removing unused access keys, and validating OIDC group-to-role mappings. It also advises preserving logs and checking login, key, and cluster-import activity if an instance is found exposed, and verifying ownership of any public instance without attempting to log in to unknown assets.