{"id":"CVE-2025-9708","state":"PUBLISHED","title":"Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks","description":"A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.","publishedAt":"2025-09-16T21:08:05.189Z","updatedAt":"2025-11-04T21:15:23.948Z","severity":{"score":6.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","source":"kubernetes"},"assigner":"kubernetes","products":["Kubernetes Kubernetes CSharp Client"],"affected":[{"vendor":"Kubernetes","product":"Kubernetes CSharp Client","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"17.0.13","versionType":"semver"},{"version":"17.0.14","status":"unaffected"}]}],"references":["https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ","https://github.com/kubernetes/kubernetes/issues/134063","http://www.openwall.com/lists/oss-security/2025/09/16/1"],"weaknesses":["CWE-295"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9708.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-9708","state":"PUBLISHED","datePublished":"2025-09-16T21:08:05.189Z","dateUpdated":"2025-11-04T21:15:23.948Z","assignerShortName":"kubernetes","assignerOrgId":"a6081bf6-c852-4425-ad4f-a67919267565","dateReserved":"2025-08-29T16:21:58.881Z"},"containers":{"cna":{"title":"Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks","descriptions":[{"lang":"en","value":"A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation."}],"affected":[{"vendor":"Kubernetes","product":"Kubernetes CSharp Client","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"17.0.13","versionType":"semver"},{"version":"17.0.14","status":"unaffected"}]}],"references":[{"url":"https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ","tags":["mailing-list"]},{"url":"https://github.com/kubernetes/kubernetes/issues/134063","tags":["issue-tracking"]}],"metrics":[{"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.8,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"format":"CVSS","scenarios":[{"lang":"en","value":"Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","lang":"en","description":"CWE-295 Improper Certificate Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"kubernetes","orgId":"a6081bf6-c852-4425-ad4f-a67919267565","dateUpdated":"2025-09-16T21:08:05.189Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"elliott-beach"}],"datePublic":"2025-09-16T02:30:00.000Z","impacts":[{"capecId":"CAPEC-94","descriptions":[{"lang":"en","value":"CAPEC-94 Man in the Middle Attack"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><div>Deploy the patch version of the Kubernetes C# client as soon as possible. Alternatively, move the CA certificates into the system trust store instead of specifying them in the kubeconfig file. Note: This approach may introduce new risks, as all processes on the system will begin to trust certificates signed by that CA. If you must use an affected version, you can disable custom CA and add the CA to the machine's trusted root.</div></div>"}],"value":"Deploy the patch version of the Kubernetes C# client as soon as possible. Alternatively, move the CA certificates into the system trust store instead of specifying them in the kubeconfig file. Note: This approach may introduce new risks, as all processes on the system will begin to trust certificates signed by that CA. If you must use an affected version, you can disable custom CA and add the CA to the machine's trusted root."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-17T13:42:50.384978Z","id":"CVE-2025-9708","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-17T13:42:59.781Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/09/16/1"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T21:15:23.948Z"}}]}}}