KubeSphere cluster-controller: Cluster CRD endpoint is fetched unvalidated, giving SSRF from the controller pod

Impact

Reconciliation of any Cluster custom resource immediately calls Discovery.ServerVersion against whatever API endpoint the CR names. The value is run through url.Parse for syntax only - there is no allow- or deny-list for loopback, RFC1918, link-local or cloud metadata addresses such as 169.254.169.254. Anyone who can create or edit a Cluster CR therefore makes a privileged controller in the management cluster issue requests to internal targets on their behalf. On a multi-cluster GPU fleet that controller is one of the most network-privileged pods in the host cluster, and node metadata endpoints are a normal source of cloud credentials, so the confidentiality-high rating is about what comes back from those internal targets.

Who can reach it

Authenticated user holding create or update rights on Cluster custom resources in the KubeSphere host cluster; no access to the target service itself is required, the controller reaches it.

What to do

No fixed KubeSphere version is named in the record - the references are the upstream repository and a third-party write-up - so treat this as mitigate-for-now. Tighten RBAC so only cluster administrators can create or modify Cluster CRs, and apply a NetworkPolicy to the ks-controller-manager pod that blocks link-local, loopback and private ranges it has no business calling. Picking up an upstream fix means rolling the ks-controller-manager deployment, which is a controller restart rather than a node drain.

References

Related entries

• Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium
• Harbor: Robot accounts in other projects can be updatedCVE-2022-31667 · HarborMedium
• Harbor: Incorrect permission validation lets authenticated users modify Harbor configurationCVE-2024-22278 · HarborMedium
• Helm: Relative path in a chart name writes the chart outside the intended directoryCVE-2024-25620 · HelmMedium
• KubeVirt: SSRF in the virt-api port-forward handler via attacker-influenced VMI status IPCVE-2026-13318 · KubeVirtMedium
• Traefik: A tenant with HTTPRoute creation rights exposes the REST provider handler, bypassing provider isolationCVE-2026-44774 · TraefikMedium