KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate basic-auth credentials from Secrets in any namespace by leveraging the endpoint's error response handling.

KubeSphere versions through 4.1.3 contain a server-side request forgery (SSRF) vulnerability in the git credential verification endpoint. The endpoint accepts unvalidated caller-supplied URLs without any allowlist restrictions, allowing authenticated attackers to supply arbitrary URLs. This enables attackers to reach internal services and potentially exfiltrate basic-auth credentials stored in Kubernetes Secrets across any namespace. The vulnerability is exploited by leveraging the endpoint's error response handling to expose sensitive credential data. The flaw is located in the handler and git model components of the KubeSphere codebase. Successful exploitation requires authentication but can lead to significant privilege escalation and data exfiltration within a Kubernetes cluster. The issue has been reported via GitHub issues and documented by VulnCheck.