PT-2026-104665

CVE-2026-105223

Published

2026-10-05

Updated

2026-10-05

Description by

CVSS 4.0

9.1

Critical

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions maclof kubernetes-client versions 0.17.0 through 0.31.x

Description TLS certificate verification is disabled in the parseKubeconfig() and parseKubeconfigFile() functions when a kubeconfig lacks certificate-authority-data, which causes the system to ignore insecure-skip-tls-verify. This allows on-path attackers to impersonate the Kubernetes API server to capture Basic credentials or Bearer tokens and tamper with REST API or WebSocket traffic.

Recommendations Update maclof kubernetes-client to version 0.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Siyang Wu

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation

Related identifiers