{"id":"CVE-2026-91923","title":"KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions","summary":"KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply ar…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"kubesphere","product":"kubesphere","affected":["kubesphere <= 4.1.3"],"published":"2026-09-15","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:18:04.553","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91923","references":[{"url":"https://github.com/kubesphere/kubesphere","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/config/ks-core/templates/globalroles.yaml","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/kapis/resources/v1alpha2/handler.go","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kubesphere/kubesphere/blob/3ef3a6bc98b790480577e87fbc75bee5b3438862/pkg/models/git/git.go","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kubesphere/kubesphere/issues/6653","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/kubesphere-through-4.1.3-ssrf-via-git-credential-verification-endpoint","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00269,"epssPercentile":0.19322,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-18T17:15:05.557314Z"},"ingestedAt":"2026-09-15T11:36:07.420Z","slug":"CVE-2026-91923","body":"## Overview\n\nKubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}