CyberSecBulletin

OpenKruise vulnerabilities

We track 2 vulnerabilities in OpenKruise products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest OpenKruise vulnerabilities

  • 7.5 High severity

    kruise-manager: Uncontrolled Resource Consumption

    CVE-2026-120656OpenKruise

    OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

  • 7.6 High severity

    kruise: Server-Side Request Forgery

    CVE-2026-24005OpenKruise

    Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these