Executive brief
KubeSphere is a container platform used to manage Kubernetes clusters across multiple clouds and datacenters. A vulnerability in its git credential verification endpoint allows authenticated attackers to submit arbitrary URLs without validation, enabling them to reach internal services and steal basic authentication credentials stored in the platform's secret management system.
Technical details
The vulnerability is a server-side request forgery (SSRF) in KubeSphere's git credential verification endpoint. The vulnerable component accepts caller-supplied URLs without validation or allowlist restrictions. Authenticated attackers can exploit this to make the server connect to arbitrary internal services and extract basic-auth credentials from Kubernetes Secrets in any namespace by abusing the endpoint's error response handling. The issue affects KubeSphere through version 4.1.3. Attack requires authentication to access the endpoint.
Affected products
- KubeSphere KubeSphere through 4.1.3
Timeline
- 2026-09-15: disclosed