EUVD-2026-53205
GHSA-w56j-p32j-vmh4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
S:C chosen over NVD's S:U because SSRF pivots to cloud IMDS and internal hosts outside the cluster's security authority; all other metrics align with the NVD vector.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
4DescriptionCVE.org
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints.
AnalysisAI
Server-Side Request Forgery in KubeSphere's multi-cluster controller allows any low-privileged user with Cluster CRD create or update permissions to weaponize the controller-manager and apiserver pods as HTTP proxies against arbitrary internal addresses, RFC1918 networks, and cloud instance metadata services including AWS IMDS at 169.254.169.254. The flaw resides in pkg/utils/clusterclient/clusterclient.go (addCluster), where the CRD-specified Kubernetes API endpoint undergoes only Go url.Parse() syntax validation before Discovery().ServerVersion() is called - no loopback, private-range, link-local, or metadata-address filtering is applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold Kubernetes RBAC permissions granting 'create' or 'update' verbs on the `clusters` resource in the `cluster.kubesphere.io` API group - this is a low-privilege but non-default permission that must be deliberately assigned via a ClusterRole or Role binding, not simply being an authenticated Kubernetes user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects the low-privilege prerequisite and high confidentiality impact, but the S:U (Unchanged scope) assignment likely understates real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with an explicit fixed version has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all KubeSphere deployments running the vulnerable multi-cluster controller and identify which users or service accounts possess Cluster CRD create/update permissions-these users represent your immediate attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today