GHSA-w7r3-mgwf-4mqqMediumCVSS 6.8

Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain

Published
September 17, 2025
Last Modified
November 5, 2025

🔗 CVE IDs covered (1)

📋 Description

A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.

🎯 Affected products1

  • nuget/KubernetesClient:< 17.0.14

🔗 References (5)