CVE-2026-120656

EUVD-2026-115361
OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
certccCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
openkruisekruise
𝑥
≤ 1.9.2
CNA
References
https://github.com/openkruise/kruise/pull/2613
https://github.com/openkruise/kruise/releases/tag/v1.9.2
https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md