CVE-2026-71208

MEDIUM 6.5

KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).

CWE	CWE-918
Vendor	kubesphere
Product	kubesphere
Published	Aug 5, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for kubesphere kubesphere

Be the first to know when new medium vulnerabilities affecting kubesphere kubesphere are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

kubesphere / KubeSphere

4.0.0 ≤ 4.1.3-rc.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md github.com: https://github.com/kubesphere/kubesphere

Credits

Ashik Mohamed