CVE-2026-120656

Description

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.

References

https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md

https://github.com/openkruise/kruise/releases/tag/v1.9.2

https://github.com/openkruise/kruise/pull/2613

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115361

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3