CVE-2026-91923

KubeSphere through 4.1.3 contains a server-side request forgery (SSRF) flaw in the git credential verification endpoint, which accepts caller-supplied URLs without any allowlist or validation. An authenticated attacker supplies an arbitrary URL to the endpoint, causing the KubeSphere server to make requests to reachable internal services. Because of how the endpoint handles error responses, the attacker can use this to exfiltrate basic-auth credentials stored in Kubernetes Secrets in any namespace, crossing tenant boundaries on multi-tenant clusters. All KubeSphere deployments up to and including version 4.1.3 are affected, though exploitation requires a valid account (CVSS 4.0: 8.3, high). No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so exploitation is not currently observed.

What to do: Upgrade KubeSphere to a release newer than 4.1.3 as soon as a fix ships, since the data does not identify a patched version. In the meantime, restrict network egress from the KubeSphere console/API server pods to internal services via Kubernetes NetworkPolicies, and limit who can reach the git credential verification endpoint. Audit Secrets cluster-wide for embedded basic-auth credentials, rotate any that may have been exposed, and review KubeSphere audit logs for suspicious calls to the credential-verification endpoint with internal or unexpected target URLs.