Live › vulnerability › CVE-2026-120656
When enabled, OpenKruise's kruise-manager listens on 0.0.0.0:8090 with an unauthenticated pprof endpoint. Any pod with RBAC access can trigger it to cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Teams running OpenKruise kruise-manager in Kubernetes clusters with the pprof endpoint enabled. The sources do not say whether the default configuration exposes it, so unknown. Clusters where the endpoint is disabled can skip it.
No product ranges from the sources yet.
8090 is exposed on 0.0.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.
This page as .md · .json · in your agent: get_signal("CVE-2026-120656")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.