Kubesphere
Approved changes feed: RSS · Atom
cpe:2.3:a:kubesphere:kubesphere:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Kubesphere (c7a703bf-7171-5336-ac67-956b734dbe2b) |
|---|---|
| Product | Kubesphere (a3230ba0-54fc-512a-a893-b2d93910c498) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71208 |
vulnerable | 2026-09-16 04:32:59.751832 |
KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
MEDIUM (6.5)
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).
Published: 2026-08-05T06:59:13.308Z
Updated: 2026-08-12T07:44:02.257Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91923 |
vulnerable | 2026-09-16 04:32:55.589918 |
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
HIGH (7.7)
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
Published: 2026-09-15T11:00:51.698Z
Updated: 2026-09-24T14:22:28.883Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46528 |
vulnerable | 2026-06-08 06:48:10.132149 |
Details available
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Published: 2024-10-14T00:00:00.000Z
Updated: 2025-08-28T15:37:59.437Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.