CVE-2026-91923
HighCVSS 7.7Summary
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace.
Risk Assessment
An authenticated attacker can reach internal services and exfiltrate credentials from Kubernetes Secrets, potentially leading to privilege escalation and cluster compromise.
Recommendation
Update KubeSphere to a version newer than 4.1.3; until then, restrict access to the git credential verification endpoint and enforce an allowlist of permitted URLs.
Other vulnerabilities in KubeSphere
See all- CVE-2026-71208Medium
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).
- CVE-2026-55998Medium
The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster with private registry secrets, a nil pointer dereference causes HTTP 502. For non-existent cluster IDs, it returns HTTP 200. This observable difference constitutes a reliable enumeration oracle.
Original NVD description (English source)
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.