---
id: CVE-2026-71208
title: >-
  KubeSphere's cluster-controller reconciliation
  (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster
  custom resource's connection configuration and immediately calls
  Discovery.ServerVersion against the CRD-specif…
summary: >-
  KubeSphere's cluster-controller reconciliation
  (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster
  custom resource's connection configuration and immediately calls
  Discovery.ServerVersion against the CRD-specif…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-05'
updated: '2026-08-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71208'
references:
  - url: >-
      https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
  - url: 'https://github.com/kubesphere/kubesphere'
    label: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
tags:
  - nvd
epss: 0.00209
epssPercentile: 0.11313
ingestedAt: '2026-08-10T12:39:48.389Z'
---

## Overview

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.