Database/Container, Kubernetes & orchestration
maclof kubernetes-client: kubeconfig without CA data silently disables API server certificate verification
Impact
Any tooling built on this PHP Kubernetes client that loads a kubeconfig lacking certificate-authority-data ends up with certificate verification off, and the explicit insecure-skip-tls-verify setting is ignored - so an operator who believes they configured strict verification does not get it. An on-path attacker between the tool and the API server can impersonate the apiserver, capture the Bearer token or Basic credentials the client presents, and tamper with REST and WebSocket traffic. Those credentials are usually a service account or admin context for the cluster that schedules GPU work, so the payoff is cluster-level, not tool-level. Exploitation needs a position on the network path, which is why the vector is scored high attack complexity.
Who can reach it
Network attacker in an on-path position between the client and the Kubernetes API server. No authentication needed; the client itself hands over its credentials to whatever certificate is presented.
What to do
Upgrade the maclof/kubernetes-client dependency to 0.32.0 or later and redeploy the consuming service. Also audit kubeconfigs used by that tooling for missing certificate-authority-data, since that is the condition that triggers the unsafe path. This is an application dependency bump and restart - no node or cluster maintenance window.
References
Related entries
- Envoy Gateway: path-normalization gap in the Lua validator lets submitted Lua read controller pod filesCVE-2026-53713 · Envoy Gateway controller (Lua validator, EnvoyExtensionPolicy)Critical
- Argo CD: Stored XSS via a `javascript:` link executes in an admin's browserCVE-2022-31035 · Argo CDCritical
- Argo CD: Improper authorization causes the API to accept tokens it should rejectCVE-2023-22482 · Argo CDCritical
- AKS Confidential Containers: elevation of privilege across the confidential container boundaryCVE-2024-21400 · Azure Kubernetes Service Confidential Containers (az confcom tooling)Critical
- Argo CD: Improper URL protocol filtering in link annotations enables client-side attacks against adminsCVE-2024-28175 · Argo CDCritical
- Argo CD: An unprivileged pod in any namespace can reach the unauthenticated Argo CD Redis on 6379 and poisonCVE-2024-31989 · Argo CDCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.