SSRF Vulnerability in KubeSphere's Cluster Controller Processing
CVE-2026-71208

7.1HIGH

Key Information:

Vendor

Kubesphere

Status
Kubesphere
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71208?

KubeSphere's cluster-controller reconciliation can be exploited due to inadequate validation of connection configurations. The process immediately accesses the specified Kubernetes API endpoint through Discovery().ServerVersion(), relying solely on URL syntax validation without implementing an allow/deny-list for sensitive address ranges, including loopback and cloud-metadata addresses. This flaw allows a malicious user with the ability to create or modify a Cluster Custom Resource Definition (CRD) to orchestrate outbound requests from the controller-manager and apiserver pods to unauthorized internal or metadata services, posing a significant security risk.

Affected Version(s)

KubeSphere 4.0.0 <= 4.1.3-rc.0

References

https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20v...
https://github.com/kubesphere/kubesphere

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ashik Mohamed
.