Vulnerabilidades de Kubesphere
CVEs publicadas que afetam produtos de Kubesphere: 2 registro(s), com severidade, exploração e correções.
CVE-2026-91923
Alta · 7.7
CWE-918 15/09/2026
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
CVE-2026-71208
Média · 6.5
CWE-918 05/08/2026
KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).