CVE-2026-71208

Name of the Vulnerable Software and Affected Versions KubeSphere (affected versions not specified)

Description The cluster-controller reconciliation process in the addCluster function (located in pkg/utils/clusterclient/clusterclient.go) processes connection configurations for Cluster custom resources. It calls Discovery().ServerVersion() against the specified Kubernetes API endpoint after performing only basic URL syntax parsing via url.Parse. Because there is no allow or deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (such as 169.254.169.254), a user with permissions to create or update a Cluster CRD can force the controller-manager and apiserver pods to send outbound requests to arbitrary internal or metadata endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.