CVE-2026-120656
waiting for further signalsZero needs more public information before it can validate it.description
OpenKruise kruise-manager can expose an unauthenticated diagnostic endpoint on all network interfaces when that endpoint is enabled. A pod with applicable RBAC access may use the exposed service to cause denial of service.
mitigation
Disable the diagnostic endpoint where it is not required. Restrict pod network access to port 8090 and avoid exposing that port outside the intended management path.
outcome
No artifact: an exploit or check was attempted but could not be produced at this moment.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-02 18:44Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-120656
{ "etk_id": "ETK-2026-3309", "cve_id": "CVE-2026-120656", "display_id": "CVE-2026-120656", "ghsa_id": null, "euvd_id": "EUVD-2026-115361", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated diagnostic endpoint exposure in kruise-manager", "summary": "OpenKruise kruise-manager can expose an unauthenticated diagnostic endpoint on all network interfaces when that endpoint is enabled. A pod with applicable RBAC access may use the exposed service to cause denial of service.", "mitigation": "Disable the diagnostic endpoint where it is not required. Restrict pod network access to port 8090 and avoid exposing that port outside the intended management path.", "vendor": "OpenKruise", "product": "kruise-manager", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.9.2" ], "ecosystem": null, "fixed_versions": [], "package_name": "kruise-manager", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 126.97369296666666, "t0_at": "2026-11-02T18:44:34.399000+00:00", "signals": { "trigger_signal": { "at": "2026-11-02T18:44:34.399000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-02T18:44:34.399000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-120656" } } }
published 2026-11-02 20:18Z
last change 2026-11-02 23:24Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.