Security Advisory

CVE-2026-71208

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-05 06:59:13

Last updated 2026-08-05 13:20:20

Assigner TuranSec

CVSS score not scored

State PUBLISHED

Description

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints.

← Browse all CVEs View on cve.org ↗