CVE-2026-120656

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-120656
OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.
CVSS

No CVSS.

References
Link Resource
https://github.com/openkruise/kruise/pull/2613
https://github.com/openkruise/kruise/releases/tag/v1.9.2
https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md
Configurations

No configuration.

History

03 Nov 2026, 16:17

Type Values Removed Values Added
Summary (en) OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod. (en) OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

02 Nov 2026, 19:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-11-02 19:18

Updated : 2026-11-03 16:17

NVD link : CVE-2026-120656

Mitre link : CVE-2026-120656

CVE.ORG link : CVE-2026-120656

JSON object : View

Products Affected

No product.

CWE

No CWE.