PT-2026-68046

Name of the Vulnerable Software and Affected Versions KubeSphere affected versions not specified Description The cluster-controller reconciliation process in the addCluster function located in pkg/utils/clusterclient/clusterclient.go processes connection configurations for Cluster custom resource...

CVE-2026-71208: Server-Side Request Forgery (SSRF)

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...