maclof kubernetes-client CVE-2026-105223

Exploitation requires three concrete conditions. (1) The application must load a kubeconfig via parseKubeconfig() or parseKubeconfigFile() that LACKS certificate-authority-data while pointing at an https:// server - in that case vulnerable versions set verify off and ignore the insecure-skip-tls-verify flag entirely. (2) The affected version must be in range 0.17.0 through 0.31.x (fixed in 0.32.0). (3) The attacker must already occupy an on-path/man-in-the-middle position between the client and the Kubernetes API server (the AT:P attack requirement), which is the primary limiting factor - this is not remotely exploitable without traffic interception. Deployments that supply certificate-authority-data in their kubeconfig are not affected, which further limits real-world exposure.

This is a genuine but conditional MITM/transport-security flaw (CWE-295), not an overrated high-CVSS issue, though its real-world urgency is lower than the 9.1 score alone suggests. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) is internally consistent with the description: unauthenticated from the attacker's side (PR:N) but gated by two non-trivial preconditions - high attack complexity (AC:H) and a present attack requirement (AT:P), reflecting that the attacker must already hold an on-path/man-in-the-middle position between the PHP client and the Kubernetes API server. The impact pairing is well-justified: high confidentiality (capture of Bearer tokens / Basic credentials) and high integrity (tampering with REST and WebSocket traffic), with no availability impact (VA:N), matching the committed fix which re-enables TLS verification by default. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, and the source-code evidence shows only a bug fix plus unrelated refactors - no weaponized exploit. The signals therefore align rather than conflict: a legitimately severe credential-exposure bug whose exploitation is constrained to adversaries who can already intercept traffic, making it a priority for operators who use this library over untrusted networks rather than an internet-wide mass-exploitation threat.

A PHP application uses maclof/kubernetes-client (0.17.0-0.31.x) with a kubeconfig that omits certificate-authority-data and points at an https API server, causing the client to silently skip TLS verification. An attacker positioned on the network path (e.g. shared/untrusted LAN, compromised proxy, or rogue DNS) presents a forged certificate for the API server, captures the client's Bearer token or Basic credentials, and then relays or alters REST/WebSocket requests to the real cluster. No public exploit code is identified at time of analysis, so exploitation requires the attacker to build their own interception setup.