Unauthenticated Endpoint in OpenKruise Manager Exposes Vulnerability

CVE-2026-120656

What is CVE-2026-120656?

The OpenKruise Kruise Manager has a vulnerability due to the exposure of an unauthenticated ppof endpoint when enabled. This endpoint is accessible at 0.0.0.0:8090, making it susceptible to potential denial-of-service (DoS) attacks. Any pod with Role-Based Access Control (RBAC) can trigger this vulnerability, potentially leading to system instability and disruption. Users are advised to review their configurations and apply patches provided in the latest releases.

References