CVE-2026-24005

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24005", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.659Z", "datePublished": "2026-02-25T18:53:30.170Z", "dateUpdated": "2026-02-26T20:44:09.282Z"}, "containers": {"cna": {"title": "OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g"}, {"name": "https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613", "tags": ["x_refsource_MISC"], "url": "https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613"}, {"name": "https://github.com/openkruise/kruise/releases/tag/v1.7.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/openkruise/kruise/releases/tag/v1.7.5"}, {"name": "https://github.com/openkruise/kruise/releases/tag/v1.8.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/openkruise/kruise/releases/tag/v1.8.3"}], "affected": [{"vendor": "openkruise", "product": "kruise", "versions": [{"version": ">= 1.8.0, < 1.8.3", "status": "affected"}, {"version": "< 1.7.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:53:30.170Z"}, "descriptions": [{"lang": "en", "value": "Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. Versions 1.8.3 and 1.7.5 patch the issue."}], "source": {"advisory": "GHSA-9fj4-3849-rv9g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:43:44.591768Z", "id": "CVE-2026-24005", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:44:09.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24005", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:43:44.591768Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:43:50.880Z"}}], "cna": {"title": "OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field", "source": {"advisory": "GHSA-9fj4-3849-rv9g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "openkruise", "product": "kruise", "versions": [{"status": "affected", "version": ">= 1.8.0, < 1.8.3"}, {"status": "affected", "version": "< 1.7.5"}]}], "references": [{"url": "https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g", "name": "https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613", "name": "https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openkruise/kruise/releases/tag/v1.7.5", "name": "https://github.com/openkruise/kruise/releases/tag/v1.7.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openkruise/kruise/releases/tag/v1.8.3", "name": "https://github.com/openkruise/kruise/releases/tag/v1.8.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. Versions 1.8.3 and 1.7.5 patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T18:53:30.170Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24005", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:44:09.282Z", "dateReserved": "2026-01-19T18:49:20.659Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T18:53:30.170Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kruise", "vendor": "openkruise", "versions": [{"status": "affected", "version": ">= 1.8.0, < 1.8.3"}, {"status": "affected", "version": "< 1.7.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openkruise:kruise:*:*:*:*:*:*:*:*", "matchCriteriaId": "D53D811F-DD4D-41A2-9B01-6627A7A3D657", "versionEndExcluding": "1.7.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:openkruise:kruise:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A6B76A0-02C5-4E39-99B1-1C8BD3758257", "versionEndExcluding": "1.8.3", "versionStartIncluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. Versions 1.8.3 and 1.7.5 patch the issue."}, {"lang": "es", "value": "Kruise proporciona gesti\u00f3n automatizada de aplicaciones a gran escala en Kubernetes. Antes de las versiones 1.8.3 y 1.7.5, PodProbeMarker permite definir sondas personalizadas con manejadores TCPSocket o HTTPGet. La validaci\u00f3n del webhook no restringe el campo Host en estas configuraciones de sonda. Dado que kruise-daemon se ejecuta con hostNetwork=true, ejecuta sondas desde el espacio de nombres de red del nodo. Un atacante con permiso de creaci\u00f3n de PodProbeMarker puede especificar valores de Host arbitrarios para activar SSRF desde el nodo, realizar escaneo de puertos y recibir retroalimentaci\u00f3n de la respuesta a trav\u00e9s de mensajes de estado de NodePodProbe. Las versiones 1.8.3 y 1.7.5 parchean el problema."}], "id": "CVE-2026-24005", "lastModified": "2026-06-17T10:22:27.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24005", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:43:44.591768Z", "version": "2.0.3"}}]}, "published": "2026-02-25T19:43:21.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/openkruise/kruise/releases/tag/v1.7.5"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/openkruise/kruise/releases/tag/v1.8.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.8.0,1.8.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kruise", "source": "cna", "vendor": "openkruise"}, "product": "kruise", "vendor": "openkruise"}], "analysis": {"en": {"generated_at": "2026-04-18T10:38:04.428067+00:00", "value": {"mitigation_remediation": ["Update to OpenKruise Kruise v1.8.3 or v1.7.5 to eliminate the SSRF vulnerability", "Restrict PodProbeMarker creation permissions to trusted administrators alone", "If an immediate upgrade is not possible, disable hostNetwork for the kruise\u2011daemon to prevent probes from executing in the node\u2019s namespace", "Monitor NodePodProbe status logs for anomalous external requests and consider blocking suspicious Host values at the admission webhook"], "summary": {"action": "Patch Immediately", "impact": "Unrestricted Host Field SSRF in OpenKruise PodProbeMarker permits a privileged actor to force the kubelet to send arbitrary requests from the node network namespace, allowing port scanning or data exfiltration"}, "threat_synthesis": {"affected_systems": "Affected systems include deployments of OpenKruise Kruise version 1.7.4 and earlier, and versions up to 1.8.2. Versions 1.8.3 and 1.7.5 are patched and no longer vulnerable. If a user employs a different branch or fork it is recommended to review the same code path that is impacted in the released patches.", "description_and_impact": "The flaw lies in the validation of the Host field of TCPSocket or HTTPGet handlers in PodProbeMarker objects. The admission webhook does not constrain this field, and because kruise\u2011daemon operates with hostNetwork=true, the probes execute in the node\u2019s network namespace. This turns the node into a proxy that can reach internal or external services specified by the attacker, resulting in server\u2011side request forgery (SSRF). The consequence is a breach of confidentiality and network isolation, potentially exposing private networks or other cluster nodes. The weakness is a classic insecure input validation issue (CWE\u2011918).", "risk_and_exploitability": "The EPSS score is below 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, because the flaw allows arbitrary network requests from the node, the potential impact is significant if an attacker gains PodProbeMarker creation rights. The control plane\u2019s admission webhook is a central point of attack, and exploitation requires the ability to create or modify PodProbeMarker objects. The attack vector is inferred to be from within the cluster, leveraging permissions to create PodProbeMarker resources."}}}}, "created": "2026-02-26T13:15:01.462612+00:00", "updated": "2026-04-18T10:45:43.657302+00:00", "vendors": ["openkruise", "openkruise$PRODUCT$kruise"]}