CVE-2026-105223

EUVD-2026-92155
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.76%
Common Weakness Enumeration
References
https://github.com/maclof/kubernetes-client
https://github.com/maclof/kubernetes-client/blob/0.31.0/src/Client.php#L309-L312
https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b0948127609e99d0e6f34
https://github.com/maclof/kubernetes-client/issues/135
https://github.com/maclof/kubernetes-client/releases/tag/0.32.0
https://www.vulncheck.com/advisories/maclof-kubernetes-client-0.17.0-before-0.32.0-disabled-tls-certificate-verification