CVE-2026-120656
Deferred Deferred - Pending Action

Unauthenticated DoS via PPOF Endpoint in OpenKruise

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: CERT/CC

Description
OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120656

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenKruise kruise-manager 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120656 is a vulnerability in OpenKruise's kruise-manager component where unauthenticated pprof profiling endpoints are enabled by default on port 8090. This allows any pod on the cluster network to access these endpoints without authentication or TLS, potentially causing resource exhaustion in the kruise-manager process.

Detection Guidance

Check if the kruise-manager pod is listening on port 8090 without authentication by running: kubectl get pods -n kruise-system -o wide. Then verify open ports with: kubectl exec -it <kruise-manager-pod> -- netstat -tuln | grep 8090. If pprof is enabled, it will show LISTEN on 0.0.0.0:8090.

Impact Analysis

An attacker could exploit this vulnerability to perform a denial-of-service attack, exhausting the kruise-manager's resources. This may cause the kruise-manager to become unresponsive, triggering its fail-closed policy and blocking pod and workload creation across the entire cluster.

Mitigation Strategies

Upgrade to OpenKruise v1.9.2 or later where pprof endpoints are disabled by default. Alternatively, manually disable pprof by setting --enable-pprof=false in kruise-manager arguments or restrict access using a NetworkPolicy to block external access to port 8090.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...