CVE-2026-71208: KubeSphere: SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

Published Aug 5, 2026

Updated

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints.

Affected Software

1 affected component

KubeSphere cluster-controller

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Add network egress controls so cluster-controller-manager and apiserver pods cannot reach loopback (127.0.0.0/8), RFC1918 private ranges, link-local, or cloud metadata IPs (e.g., 169.254.169.254), limiting outbound traffic from the reconciliation component that calls Discovery().ServerVersion() on the Cluster CRD-specified endpoint.

Event History

Aug 5, 2026

CVE Published

via MITRE·06:59 AM

Data Sourced

via MITRE·06:59 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-71208?

The severity of CVE-2026-71208 is rated high with a score of 7.1.

What type of vulnerability is CVE-2026-71208?

CVE-2026-71208 is a Server-Side Request Forgery (SSRF) vulnerability.

How do I fix CVE-2026-71208?

To fix CVE-2026-71208, ensure that user input for Cluster custom resource's connection configuration is validated before being used.

Which software is affected by CVE-2026-71208?

CVE-2026-71208 affects the KubeSphere cluster-controller.

What is the impact of CVE-2026-71208?

The impact of CVE-2026-71208 allows an attacker to potentially access sensitive data or services within the network due to unvalidated API endpoint connections.