OpenKruise kruise-manager exposes unauthenticated pprof, enabling denial of service
A tool that manages Kubernetes clusters can be stalled by anyone on the same network.
Summary
OpenKruise kruise-manager opens an unauthenticated pprof diagnostic endpoint on 0.0.0.0:8090 by default. Any pod on the cluster network can trigger a denial-of-service attack.
Affected when
- Default configuration
- Pods with access to the cluster network
What to do
Check that the product runs version 1.9.2 or newer, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen