CVE-2026-71208
Received Received - Intake

KubeSphere Cluster CRD Arbitrary Outbound Requests

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71208
EUVD
EUVD-2026-53205

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kubesphere kubesphere 4.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in KubeSphere allows a user who can create or update a Cluster custom resource definition (CRD) to force the cluster-controller to make outbound requests to arbitrary internal or metadata endpoints. The controller processes connection configurations and calls Discovery().ServerVersion() against specified Kubernetes API endpoints without validating the URL against private, loopback, or cloud-metadata address ranges.

Detection Guidance

Check KubeSphere controller-manager logs for outbound requests to unexpected internal or metadata endpoints. Monitor network traffic from controller-manager pods to detect connections to loopback, RFC1918, link-local, or cloud-metadata addresses.

Impact Analysis

An attacker with CRD update permissions could exploit this to make the controller-manager and apiserver pods send requests to internal systems or cloud metadata services. This could lead to information disclosure, unauthorized access to sensitive endpoints, or potential denial-of-service conditions if the targeted services are overwhelmed.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized network access to sensitive systems or data. GDPR may be impacted if personal data is exposed through internal endpoints. HIPAA could be compromised if protected health information is accessible via exploited metadata services. Organizations must ensure proper access controls and network segmentation to mitigate risks.

Mitigation Strategies

Restrict Cluster CRD creation/update permissions to trusted users only. Implement network policies to block outbound traffic from controller-manager pods to unauthorized internal endpoints. Update KubeSphere to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart