CVE-2026-93685
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.
Risk Assessment
An unauthenticated attacker can obtain operational information about the cluster, potentially aiding reconnaissance and further attacks on the Kubernetes environment.
Recommendation
Update multicluster-observability-addon to a patched version and restrict network access to debug endpoints.
Other vulnerabilities in multicluster-observability-addon
Original NVD description (English source)
A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS