GitHub Advisoryadvisory · NuGet

GHSA-w7r3-mgwf-4mqq Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain

MEDIUM Published 2025-09-17 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-9708
Ecosystem
NuGet
Packages
KubernetesClient
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2025-09-17

Affected packages

• NuGet KubernetesClient: < 17.0.14 → fixed in 17.0.14

Description

A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.

Related

Alias · CVE (1)

  • CVE-2025-9708 A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References