CVE-2026-105223
maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 0.32.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
Affected versions
- maclof kubernetes-client
From 0.17.0 · fixed in 0.32.0