TI-2025-08898 Aliases CVE-2025-9708 GHSA-w7r3-mgwf-4mqq

Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks

LOW 32CWE-295Published 2025-09-16 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00308 23rd percentileScored 2026-11-07

Fix Fixed Kubernetes CSharp Client (Kubernetes): 17.0.14KubernetesClient (NuGet): 17.0.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kubernetes	Kubernetes CSharp Client	up to 17.0.13	17.0.14	Patch available	CNA
—	KubernetesClient (NuGet)	before 17.0.14	17.0.14	Patch available	GHSA-w7r3-mgwf-4mqq

Kubernetes CSharp Client VendorKubernetes Affected up to 17.0.13 Fixed in 17.0.14 Patch available CNA
KubernetesClient (NuGet) Vendor— Affected before 17.0.14 Fixed in 17.0.14 Patch available GHSA-w7r3-mgwf-4mqq

Remediation

Fix · CNA Kubernetes CSharp Client (Kubernetes) Fixed in 17.0.14
Fix · GHSA-w7r3-mgwf-4mqq KubernetesClient (NuGet) Fixed in 17.0.14 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-9708
2026-10-03 Alias added: GHSA-w7r3-mgwf-4mqq

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-9708

Other 4

TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences