CyberRota Analysis
AI-GeneratedThe maclof kubernetes-client versions prior to 0.32.0 are vulnerable due to the disabling of TLS certificate verification in specific functions when a kubeconfig file lacks certificate-authority-data, disregarding the insecure-skip-tls-verify setting. This flaw allows on-path attackers to impersonate the Kubernetes API server, potentially capturing sensitive Bearer tokens or Basic credentials and manipulating WebSocket or REST API traffic. Organizations using affected versions of the Kubernetes client should prioritize patching to mitigate the risk of credential theft and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.