CVE-2026-105223 | CVSS: 7.4 | 严重级别: HIGH
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
参考链接:
• https://github.com/maclof/kubernetes-client
• https://github.com/maclof/kubernetes-client/blob/0.31.0/src/Client.php#L309-L312
• https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b094812760
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。