CVE-2026-71208
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).
Risk Assessment
An attacker could exploit this vulnerability to perform SSRF attacks, gaining access to internal services or cloud metadata, potentially leading to data leakage or privilege escalation.
Recommendation
It is recommended to add IP address validation in connection configurations, blocking internal and cloud metadata addresses.
Other vulnerabilities in KubeSphere
See all- CVE-2026-91923High
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace.
- CVE-2026-55998Medium
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster with private registry secrets, a nil pointer dereference causes HTTP 502. For non-existent cluster IDs, it returns HTTP 200. This observable difference constitutes a reliable enumeration oracle.
Original NVD description (English source)
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).