{"id":"CVE-2026-120656","kind":"vulnerability","aliases":["CVE-2026-120656"],"related":[],"title":"OpenKruise kruise-manager: unauthenticated pprof endpoint enables denial of service","description":"OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.","summary":"When enabled, OpenKruise's kruise-manager listens on 0.0.0.0:8090 with an unauthenticated pprof endpoint. Any pod with RBAC access can trigger it to cause a denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kruise-manager","kubernetes","openkruise"],"not_affected_if":["pprof-disabled"],"how_to_check":"- Check whether the pprof endpoint is enabled in the kruise-manager configuration and whether port `8090` is exposed on `0.0.0.0`\n- Confirm the installed OpenKruise version against the fixed release in the sources: unknown","fix":"- Fixed version: unknown\n- Upgrade to the release referenced in the vendor release notes: unknown","status":"open","published_at":"2026-11-02T19:18:04+00:00","first_seen_at":"2026-11-02T19:24:40+00:00","triaged_at":"2026-11-02T19:26:57+00:00","updated_at":"2026-11-02T19:26:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T19:26:57Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown\n- Upgrade to the release referenced in the vendor release notes: unknown","reach":"network","title":"OpenKruise kruise-manager: unauthenticated pprof endpoint enables denial of service","impact":"low","summary":"When enabled, OpenKruise's kruise-manager listens on 0.0.0.0:8090 with an unauthenticated pprof endpoint. Any pod with RBAC access can trigger it to cause a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["kubernetes","openkruise","kruise-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Any cluster pod with RBAC access can crash the manager process","analyst_note":"Confirm the affected version range and the fixed release from the linked release notes; the sources give no versions.","how_to_check":"- Check whether the pprof endpoint is enabled in the kruise-manager configuration and whether port `8090` is exposed on `0.0.0.0`\n- Confirm the installed OpenKruise version against the fixed release in the sources: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["pprof-disabled"],"who_is_affected":"Teams running OpenKruise kruise-manager in Kubernetes clusters with the pprof endpoint enabled. The sources do not say whether the default configuration exposes it, so unknown. Clusters where the endpoint is disabled can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4116,"output_tokens":564,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120656':14A,17A '-2026':13A,16A '0.0.0.0':33B,68C '8090':34B,69C 'access':44B 'attack':75C 'caus':49B 'cve':12A,15A 'denial':9A,51B 'dos':74C 'enabl':8A,25B,64C,72C 'endpoint':7A,39B,62C 'expos':58C 'infrastructur':18B 'kruis':3A,20B,29B,56C 'kruise-manag':2A,19B,28B,55C 'kubernet':22B 'listen':31B 'manag':4A,21B,30B,57C 'open':65C 'openkruis':1A,23B,26B,54C 'pod':41B,80C 'ppof':61C 'pprof':6A,38B 'rbac':43B,79C 'servic':11A,53B 'trigger':46B,76C 'unauthent':5A,37B,60C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenKruise kruise-manager in Kubernetes clusters with the pprof endpoint enabled. The sources do not say whether the default configuration exposes it, so unknown. Clusters where the endpoint is disabled can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","kruisemanager","kubernetes","medium","openkruise"],"first_public_at":"2026-11-02T19:18:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120656","severity":null,"published_at":"2026-11-02T19:18:04+00:00","modified_at":"2026-11-02T19:18:04+00:00","first_seen_at":"2026-11-02T19:24:40+00:00","fetched_at":"2026-11-02T19:24:40+00:00","note":null}],"documents":[{"id":53481,"url":"https://github.com/openkruise/kruise/releases/tag/v1.9.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}