CVE-2026-120656

CVSS 7.5 (high) · published 2026-11-02

OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

Weakness: CWE-400

Source: NVD CVE-2026-120656

References

• https://github.com/openkruise/kruise/pull/2613
• https://github.com/openkruise/kruise/releases/tag/v1.9.2
• https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.