kubesphere CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH kubesphere CVE published 2026-09-15

CVE-2026-91923

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace. This vulnerability allows for potential exfiltration of sensitive credentials and unauthorized access to internal services, emphasizing the [truncated]