CVE-2026-24005: openkruise kruise

csirt@kutim:~/threat-intel/cve/CVE-2026-24005

CVSS 7.6 · High EPSS 0,30%

Kerentanan Server-Side Request Forgery (SSRF) pada openkruise kruise. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages. Versions 1.8.3 and 1.7.5 patch the issue.

Rincian

Terbit di NVD: 25 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,30% peluang dieksploitasi; lebih tinggi dari 20,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openkruise	kruise	Semua versi sebelum 1.7.5
openkruise	kruise	Versi 1.8.0 hingga sebelum 1.8.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/openkruise/kruise/security/advisories/GHSA-9fj4-3849-rv9g exploit · mitigasi · advisory vendor
https://github.com/openkruise/kruise/commit/94364b76adf3e8a1749a31afe809a163bed29613 patch
https://github.com/openkruise/kruise/releases/tag/v1.7.5 product · release notes
https://github.com/openkruise/kruise/releases/tag/v1.8.3 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.