CVE-2026-91923
Received Received - Intake

Server-Side Request Forgery in KubeSphere

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91923
EUVD
EUVD-2026-78414

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kubesphere kubesphere to 4.1.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in KubeSphere versions up to 4.1.3. Authenticated attackers can send arbitrary URLs to the git credential verification endpoint without validation. The endpoint then makes outbound requests to these URLs, and if the target server responds with an error, the response body is returned to the attacker. This allows exfiltration of basic-auth credentials from Secrets in any namespace by leveraging the error response handling.

Detection Guidance

To detect this SSRF vulnerability in KubeSphere, monitor network traffic for outbound requests from the git credential verification endpoint (POST /kapis/resources.kubesphere.io/v1alpha2/git/verify). Check logs for suspicious URLs or errors indicating failed Git operations. Use tools like tcpdump or Wireshark to inspect traffic from the KubeSphere API server.

Impact Analysis

An attacker could access internal services, steal sensitive credentials stored in Kubernetes Secrets, and potentially gain unauthorized access to other systems or data. The vulnerability allows exfiltration of credentials from any namespace, including highly privileged ones like kube-system, posing a significant risk to data confidentiality and system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (protected health information). Organizations using affected KubeSphere versions may face legal penalties, reputational damage, and loss of certification due to failure to protect confidential data.

Mitigation Strategies

Upgrade KubeSphere to a patched version beyond 4.1.3. If immediate upgrade is not possible, restrict access to the vulnerable endpoint by updating RBAC rules to limit who can call POST /kapis/resources.kubesphere.io/v1alpha2/git/verify. Block private IP ranges in firewall rules and implement URL allowlisting for the git credential verification function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart