Kubernetes Client
Monthly
TLS certificate verification is silently disabled in the PHP library maclof/kubernetes-client versions 0.17.0 through 0.31.x whenever a loaded kubeconfig omits certificate-authority-data but points at an https:// API server; the library's parseKubeconfig() and parseKubeconfigFile() helpers then ignore the user's insecure-skip-tls-verify setting and turn verification off. This only matters to an attacker who already holds an on-path/man-in-the-middle position between the client and the Kubernetes API server, from which they can impersonate the API server, harvest Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. Exploitation is conditional rather than opportunistic - there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list it); unaffected deployments are those whose kubeconfig supplies certificate-authority-data. The 9.1 CVSS score reflects the high confidentiality and integrity impact, but real-world urgency is lower than that number suggests because of the attack-position requirement and the fix available in 0.32.0.
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
TLS certificate verification is silently disabled in the PHP library maclof/kubernetes-client versions 0.17.0 through 0.31.x whenever a loaded kubeconfig omits certificate-authority-data but points at an https:// API server; the library's parseKubeconfig() and parseKubeconfigFile() helpers then ignore the user's insecure-skip-tls-verify setting and turn verification off. This only matters to an attacker who already holds an on-path/man-in-the-middle position between the client and the Kubernetes API server, from which they can impersonate the API server, harvest Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. Exploitation is conditional rather than opportunistic - there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list it); unaffected deployments are those whose kubeconfig supplies certificate-authority-data. The 9.1 CVSS score reflects the high confidentiality and integrity impact, but real-world urgency is lower than that number suggests because of the attack-position requirement and the fix available in 0.32.0.
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.