Read the docs

kubesphere

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

kubesphere records in CISA KEV

No kubesphere vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-62059 CVE-2026-91923 · GHSA-847j-gj2f-78j9

KubeSphere through 4.1.3 SSRF via git credential verification endpoint

Priority LOW 36

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00454 Published 2026-09-15 No fix listed CWE-918
TI-2026-49883 CVE-2026-71208 · GHSA-w56j-p32j-vmh4

KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

Priority LOW 29

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion again…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00354 Published 2026-08-05 No fix listed CWE-918
Open these records in search →