Kubesphere KubeSphere vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Kubesphere KubeSphere: 2 record(s), with affected versions and fixes.

CVE-2026-91923 High · 7.7 CWE-918 Sep 15, 2026

KubeSphere through 4.1.3 SSRF via git credential verification endpoint

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.

CVE-2026-71208 Medium · 6.5 CWE-918 Aug 5, 2026

KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).