Search
Find a vulnerability
Search criteria
6 vulnerabilities by kubesphere
CVE-2026-91923 (GCVE-0-2026-91923)
Vulnerability from nvd – Published: 2026-09-15 11:00 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
Summary
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:15 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/kubesphere/kubesphere/issues/6653 | issue-tracking |
| https://github.com/kubesphere/kubesphere | product |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://www.vulncheck.com/advisories/kubesphere-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | kubesphere |
Affected:
0 , ≤ 4.1.3
(custom)
|
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:15:05.557314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:05.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/kubesphere.io/kubesphere",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "4.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint\u0027s error response handling."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:28.883Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #6653",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kubesphere/kubesphere/issues/6653"
},
{
"tags": [
"product"
],
"url": "https://github.com/kubesphere/kubesphere"
},
{
"name": "git.go - gitReadVerifyWithBasicAuth passes remoteUrl to origin.List unvalidated",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/models/git/git.go"
},
{
"name": "handler.go - VerifyGitCredential returns the go-git error to the caller",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/kapis/resources/v1alpha2/handler.go"
},
{
"name": "globalroles.yaml - authenticated GlobalRole grants create on resources.kubesphere.io git",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/config/ks-core/templates/globalroles.yaml"
},
{
"name": "VulnCheck Advisory: KubeSphere through 4.1.3 SSRF via git credential verification endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kubesphere-through-4.1.3-ssrf-via-git-credential-verification-endpoint"
}
],
"title": "KubeSphere through 4.1.3 SSRF via git credential verification endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91923",
"datePublished": "2026-09-15T11:00:51.698Z",
"dateReserved": "2026-09-15T10:42:43.665Z",
"dateUpdated": "2026-09-24T14:22:28.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71208 (GCVE-0-2026-71208)
Vulnerability from nvd – Published: 2026-08-05 06:59 – Updated: 2026-08-12 07:44
VLAI
EPSS
VEX
Title
KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
Summary
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:20 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ashikmd7/kubeSphere/blob/main/… | third-party-advisory |
| https://github.com/kubesphere/kubesphere | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | KubeSphere |
Affected:
4.0.0 , ≤ 4.1.3-rc.0
(custom)
|
Date Public
2026-08-05 06:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:20:09.859595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:20:20.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "KubeSphere",
"programFiles": [
"pkg/utils/clusterclient/clusterclient.go"
],
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "4.1.3-rc.0",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ashik Mohamed (ashikmd7)"
}
],
"datePublic": "2026-08-05T06:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKubeSphere\u0027s cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource\u0027s connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).\u003c/p\u003e"
}
],
"value": "KubeSphere\u0027s cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource\u0027s connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254)."
}
],
"metrics": [
{
"other": {
"content": {
"value": "HIGH"
},
"type": "CVSS_3.1_severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T07:44:02.257Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/kubesphere/kubesphere"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71208",
"datePublished": "2026-08-05T06:59:13.308Z",
"dateReserved": "2026-08-05T06:56:15.799Z",
"dateUpdated": "2026-08-12T07:44:02.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-46528 (GCVE-0-2024-46528)
Vulnerability from nvd – Published: 2024-10-14 00:00 – Updated: 2025-08-28 15:37
VLAI
EPSS
VEX
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-15 14:45 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | kubesphere |
Affected:
3.0.0 , ≤ 3.4.1
(custom)
Affected: 4.0 , < 4.1.3 (custom) cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:*:*:*:* |
|
| kubesphere | kubesphere |
Affected:
3.0.0 , ≤ 3.5.0
(custom)
Affected: 4.0 , < 4.1.3 (custom) cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:enterprise:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "3.4.1",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.3",
"status": "affected",
"version": "4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:enterprise:*:*:*"
],
"defaultStatus": "unknown",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.3",
"status": "affected",
"version": "4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-46528",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T14:45:11.748010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-28T15:37:59.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.kubesphere.io/news/kubesphere-cve-2024-46528/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T16:57:29.495Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere/"
},
{
"url": "https://kubesphere.io/"
},
{
"url": "https://github.com/kubesphere/kubesphere/issues/6227"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46528",
"datePublished": "2024-10-14T00:00:00.000Z",
"dateReserved": "2024-09-11T00:00:00.000Z",
"dateUpdated": "2025-08-28T15:37:59.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-91923 (GCVE-0-2026-91923)
Vulnerability from cvelistv5 – Published: 2026-09-15 11:00 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
Summary
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:15 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/kubesphere/kubesphere/issues/6653 | issue-tracking |
| https://github.com/kubesphere/kubesphere | product |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://github.com/kubesphere/kubesphere/blob/3ef… | technical-description |
| https://www.vulncheck.com/advisories/kubesphere-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | kubesphere |
Affected:
0 , ≤ 4.1.3
(custom)
|
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:15:05.557314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:05.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/kubesphere.io/kubesphere",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "4.1.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint\u0027s error response handling."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:28.883Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #6653",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kubesphere/kubesphere/issues/6653"
},
{
"tags": [
"product"
],
"url": "https://github.com/kubesphere/kubesphere"
},
{
"name": "git.go - gitReadVerifyWithBasicAuth passes remoteUrl to origin.List unvalidated",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/models/git/git.go"
},
{
"name": "handler.go - VerifyGitCredential returns the go-git error to the caller",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/kapis/resources/v1alpha2/handler.go"
},
{
"name": "globalroles.yaml - authenticated GlobalRole grants create on resources.kubesphere.io git",
"tags": [
"technical-description"
],
"url": "https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/config/ks-core/templates/globalroles.yaml"
},
{
"name": "VulnCheck Advisory: KubeSphere through 4.1.3 SSRF via git credential verification endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kubesphere-through-4.1.3-ssrf-via-git-credential-verification-endpoint"
}
],
"title": "KubeSphere through 4.1.3 SSRF via git credential verification endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91923",
"datePublished": "2026-09-15T11:00:51.698Z",
"dateReserved": "2026-09-15T10:42:43.665Z",
"dateUpdated": "2026-09-24T14:22:28.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71208 (GCVE-0-2026-71208)
Vulnerability from cvelistv5 – Published: 2026-08-05 06:59 – Updated: 2026-08-12 07:44
VLAI
EPSS
VEX
Title
KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
Summary
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 13:20 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ashikmd7/kubeSphere/blob/main/… | third-party-advisory |
| https://github.com/kubesphere/kubesphere | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | KubeSphere |
Affected:
4.0.0 , ≤ 4.1.3-rc.0
(custom)
|
Date Public
2026-08-05 06:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T13:20:09.859595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T13:20:20.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "KubeSphere",
"programFiles": [
"pkg/utils/clusterclient/clusterclient.go"
],
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "4.1.3-rc.0",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ashik Mohamed (ashikmd7)"
}
],
"datePublic": "2026-08-05T06:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKubeSphere\u0027s cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource\u0027s connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).\u003c/p\u003e"
}
],
"value": "KubeSphere\u0027s cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource\u0027s connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254)."
}
],
"metrics": [
{
"other": {
"content": {
"value": "HIGH"
},
"type": "CVSS_3.1_severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T07:44:02.257Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/kubesphere/kubesphere"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71208",
"datePublished": "2026-08-05T06:59:13.308Z",
"dateReserved": "2026-08-05T06:56:15.799Z",
"dateUpdated": "2026-08-12T07:44:02.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-46528 (GCVE-0-2024-46528)
Vulnerability from cvelistv5 – Published: 2024-10-14 00:00 – Updated: 2025-08-28 15:37
VLAI
EPSS
VEX
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-15 14:45 UTC
CWE
- n/a
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| kubesphere | kubesphere |
Affected:
3.0.0 , ≤ 3.4.1
(custom)
Affected: 4.0 , < 4.1.3 (custom) cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:*:*:*:* |
|
| kubesphere | kubesphere |
Affected:
3.0.0 , ≤ 3.5.0
(custom)
Affected: 4.0 , < 4.1.3 (custom) cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:enterprise:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "3.4.1",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.3",
"status": "affected",
"version": "4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:enterprise:*:*:*"
],
"defaultStatus": "unknown",
"product": "kubesphere",
"vendor": "kubesphere",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.3",
"status": "affected",
"version": "4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-46528",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-15T14:45:11.748010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-28T15:37:59.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.kubesphere.io/news/kubesphere-cve-2024-46528/"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T16:57:29.495Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere/"
},
{
"url": "https://kubesphere.io/"
},
{
"url": "https://github.com/kubesphere/kubesphere/issues/6227"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-46528",
"datePublished": "2024-10-14T00:00:00.000Z",
"dateReserved": "2024-09-11T00:00:00.000Z",
"dateUpdated": "2025-08-28T15:37:59.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}