CVE-2026-120656: Security vulnerability

Published Nov 2, 2026

Updated

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.

Other sources

OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

— NVD

Event History

Nov 2, 2026

CVE Published

via MITRE·06:44 PM

Data Sourced

via MITRE·06:44 PM

DescriptionWeakness

Data Sourced

via OSV·06:44 PM

Description

Data Sourced

via NVD·07:18 PM

Description

Frequently Asked Questions

Is a default deployment exposed?

Yes. The pprof endpoint is described as enabled by default and bound to 0.0.0.0:8090.

Who can trigger the denial-of-service condition?

Any pod that can reach the cluster network can trigger the attack. The endpoint does not require authentication.

What should be checked to identify exposure?

Check whether kruise-manager has an unauthenticated pprof service listening on port 8090 on all interfaces. The supplied information identifies this endpoint as enabled by default.

CVE-2026-120656: Security vulnerability

Other sources

Event History

Frequently Asked Questions

Is a default deployment exposed?

Who can trigger the denial-of-service condition?

What should be checked to identify exposure?

Company

Resources

Contact

Frequently Asked Questions

Is a default deployment exposed?

Who can trigger the denial-of-service condition?

What should be checked to identify exposure?