CVE-2026-71208

HIGH 7.1

KubeSphere: SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints.

CWE	CWE-918
Vendor	kubesphere
Product	kubesphere
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for kubesphere kubesphere

Be the first to know when new high vulnerabilities affecting kubesphere kubesphere are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

kubesphere / KubeSphere

4.0.0 ≤ 4.1.3-rc.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md github.com: https://github.com/kubesphere/kubesphere

Credits

Ashik Mohamed