CVE-2026-91923Patch

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-91923

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters45d
Patch
CVE-2026-91923: SSRF in KubeSphere (through 4.1.3) lets authed users hit internal services via the git credential endpoint and leak Secret basic-auth creds. CVSS 7.7. No patch yet, review underway - restrict endpoint access now. https://www.valtersit.com/cve/CVE-2026-91923 #CVE #infosec #Kubernetes #KubeSphere #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post announces an authenticated SSRF in KubeSphere through 4.1.3 with CVSS 7.7 and explains that the git credential endpoint can be abused to leak secrets. It states that no patch is available yet and recommends restricting endpoint access as an immediate mitigation.
1001045
1.1K followersView on X

Explore more

Back to dashboard