CVE-2026-91923: KubeSphere through 4.1.3 SSRF via git credential verification endpoint
KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KubeSphereto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to KubeSphere and able to use the git credential verification endpoint. No user interaction is required.
What access or data is at risk?
An attacker can cause the KubeSphere server to send requests to arbitrary URLs, including internal services. The endpoint's error handling can be leveraged to exfiltrate basic-auth credentials stored in Secrets in any namespace.
Are default deployments affected?
The provided information identifies KubeSphere through version 4.1.3 as affected, but does not state whether the vulnerable endpoint is enabled or reachable in a default deployment.
What can be done while a patch is unavailable?
The provided information does not specify an official workaround. Limit access to the git credential verification endpoint to trusted authenticated users and restrict the server's network access to internal services where feasible.