CVE-2026-43644

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md	Exploit Mitigation Third Party Advisory
https://github.com/stefanprodan/podinfo/issues/474	Issue Tracking
https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stefanprodan:podinfo:*:*:*:*:*:kubernetes:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) podinfo hasta la versión 6.11.2 contiene una vulnerabilidad de cross-site scripting reflejada en los endpoints /echo y /api/echo donde el echoHandler escribe el contenido del cuerpo de la solicitud directamente a la respuesta sin establecer encabezados Content-Type o X-Content-Type-Options explícitos. Los atacantes pueden crear páginas HTML de origen cruzado con formularios de envío automático que contienen cargas útiles de script en el cuerpo de la solicitud, que se sirven como text/html debido a la detección de tipo de contenido de Go, permitiendo que el script reflejado se ejecute en el contexto de origen de podinfo cuando las víctimas visitan la página del atacante.

Information

Published : 2026-05-14 13:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-43644

Mitre link : CVE-2026-43644

CVE.ORG link : CVE-2026-43644

JSON object : View

Products Affected

stefanprodan

podinfo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-43644", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43644", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T13:46:17.355351Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/stefanprodan/podinfo", "vendor": "stefanprodan", "product": "podinfo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.11.2"}], "packageURL": "pkg:golang/github.com/stefanprodan/podinfo", "defaultStatus": "affected"}]}], "published": "2026-05-14T13:16:18.770", "references": [{"url": "https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/stefanprodan/podinfo/issues/474", "tags": ["Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page."}, {"lang": "es", "value": "podinfo hasta la versi\u00f3n 6.11.2 contiene una vulnerabilidad de cross-site scripting reflejada en los endpoints /echo y /api/echo donde el echoHandler escribe el contenido del cuerpo de la solicitud directamente a la respuesta sin establecer encabezados Content-Type o X-Content-Type-Options expl\u00edcitos. Los atacantes pueden crear p\u00e1ginas HTML de origen cruzado con formularios de env\u00edo autom\u00e1tico que contienen cargas \u00fatiles de script en el cuerpo de la solicitud, que se sirven como text/html debido a la detecci\u00f3n de tipo de contenido de Go, permitiendo que el script reflejado se ejecute en el contexto de origen de podinfo cuando las v\u00edctimas visitan la p\u00e1gina del atacante."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stefanprodan:podinfo:*:*:*:*:*:kubernetes:*:*", "vulnerable": true, "matchCriteriaId": "27CA7FB3-D2D7-4E97-819F-2A044609E990", "versionEndIncluding": "6.11.12"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}