CVE-2026-91923 kubesphere CVE debrief

Who should care

Defenders responsible for KubeSphere deployments should assess exposure and prioritize verification of the git credential verification endpoint. This includes reviewing current configurations, access controls, and monitoring for suspicious activity related to the endpoint. Additionally, security teams and vulnerability management teams should be aware of the potential impacts and plan accordingly for remediation and mitigation efforts.

Why it matters

Defenders should prioritize verifying exposure of the git credential verification endpoint in their KubeSphere deployments and restrict access to the endpoint to prevent potential exfiltration of credentials and unauthorized access to internal services.

• Potential exfiltration of basic-auth credentials from Secrets in any namespace
• Possible unauthorized access to internal services

Technical summary

The git credential verification endpoint in KubeSphere through 4.1.3 accepts unvalidated caller-supplied URLs without allowlist restrictions, allowing authenticated attackers to supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace. This vulnerability is a server-side request forgery (SSRF) issue that can lead to unauthorized access and data exfiltration, highlighting the importance of validating input and restricting endpoint access. Defenders should prioritize verifying exposure of this endpoint and implement necessary controls to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure of the git credential verification endpoint in their KubeSphere deployments and restrict access to the endpoint.

Recommended defensive actions

• Verify exposure of the git credential verification endpoint in KubeSphere deployments
• Restrict access to the endpoint
• Monitor for suspicious activity
• Implement compensating controls for exposed systems
• Review asset inventory for affected systems
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional verification is needed to confirm affected versions and remediation. The vulnerability is confirmed in KubeSphere through version 4.1.3, and defenders should verify their deployments for exposure, focusing on the git credential verification endpoint's configuration and access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.