{"id":"CVE-2026-120656","published":"2026-11-02T19:18:04.440","lastModified":"2026-11-02T19:35:33.347","description":"OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://github.com/openkruise/kruise/pull/2613","tags":[]},{"url":"https://github.com/openkruise/kruise/releases/tag/v1.9.2","tags":[]},{"url":"https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/openkruise/kruise/pull/2613","tags":[]},{"url":"https://github.com/openkruise/kruise/releases/tag/v1.9.2","tags":[]},{"url":"https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md","tags":[]}],"hasPoc":true,"ai":null}