Vulnerability · Published Nov 2, 2026 · Assigned by certcc
CVE-2026-120656CVE-2026-120656
Unrated
In plain English
A security flaw in kruise-manager from OpenKruise. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 93.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenKruise | kruise-manager | 0 – before 1.9.2 |