Executive brief
Podinfo, a web application used to demonstrate Kubernetes microservices, contains a security flaw in its echo endpoints. An attacker can trick a user into visiting a malicious website that sends a hidden request to the podinfo service, causing the service to run unauthorized scripts in the user's browser. This could allow an attacker to perform actions on behalf of the user or access sensitive information within the application's session.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in podinfo's /echo and /api/echo endpoints. The root cause is the echoHandler writing the request body directly to the HTTP response without specifying a Content-Type header or an X-Content-Type-Options: nosniff header. Because the application is written in Go, the net/http stack performs MIME sniffing on the response body; if the body contains HTML or script tags, it is served as text/html. An attacker can exploit this by hosting a cross-origin HTML page with an auto-submitting form that sends a script payload in the request body. When a victim visits the attacker's page, the script is reflected and executed in the context of the podinfo origin.
Affected products
- stefanprodan podinfo <= 6.11.2
Timeline
- 2026-04-10: disclosed: Initial outreach to maintainer via GitHub issue
- 2026-05-14: advisory: Vulnerability published by VulnCheck
- 2026-06-01: other: NVD analysis and CPE enrichment