CVE-2026-105223: maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maclof kubernetes-clientto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Deployments using maclof/kubernetes-client versions from 0.17.0 up to, but not including, 0.32.0 are affected when their kubeconfig lacks certificate-authority-data. The vulnerable parsing paths are parseKubeconfig() and parseKubeconfigFile().
What access does an attacker need to exploit this?
An attacker must be positioned on the network path between the client and the Kubernetes API server. No application privileges or user interaction are required.
What could an on-path attacker obtain or change?
They can impersonate the Kubernetes API server, capture Bearer tokens or Basic credentials, and tamper with WebSocket or REST API traffic. Availability impact is not indicated by the provided vector.
How can I determine whether my environment is currently exposed?
Check whether the application uses an affected maclof/kubernetes-client version and whether the kubeconfig supplied to it omits certificate-authority-data. In that combination, TLS certificate verification is disabled regardless of the insecure-skip-tls-verify setting.
What is the available remediation?
Upgrade maclof/kubernetes-client to version 0.32.0 or later. Until upgraded, avoid using kubeconfigs that lack certificate-authority-data for affected clients.