Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-105223maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

High 7.4

In plain English

A high-severity improper certificate validation in kubernetes-client from maclof. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.

Affected products (as reported)

Vendor	Product	Versions
maclof	kubernetes-client	0.17.0 – before 0.32.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #135 issue-tracking
https://github.com/maclof/kubernetes-client product
https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b0948127609e99d0e6f34 patch
kubernetes-client 0.32.0 Release Notes release-notes
https://github.com/maclof/kubernetes-client/blob/0.31.0/src/Client.php#L309-L312 technical-description
VulnCheck Advisory: maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification third-party-advisory