CyberRota Analysis
AI-GeneratedKubeSphere's cluster-controller reconciliation process in Kubernetes is vulnerable as it allows users to create or update a Cluster custom resource definition (CRD) that can trigger outbound requests to arbitrary internal or metadata endpoints without proper validation. This could lead to unauthorized access to sensitive internal services or cloud metadata, potentially exposing critical information. Organizations using KubeSphere should prioritize addressing this vulnerability to mitigate risks associated with unauthorized data exposure and internal network attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).