CVE-2026-105223: Kubernetes Client Auth Bypass Vulnerability

CVE-2026-105223 Overview

CVE-2026-105223 is a certificate validation flaw [CWE-295] in the maclof/kubernetes-client PHP library affecting versions 0.17.0 through 0.31.x. The library disables TLS certificate verification inside parseKubeconfig() and parseKubeconfigFile() whenever a kubeconfig omits the certificate-authority-data field. The insecure-skip-tls-verify flag is ignored, so HTTPS connections silently fall back to unverified TLS. On-path attackers positioned between the client and the Kubernetes API server can impersonate the server, intercept Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic.

Critical Impact
On-path attackers can impersonate the Kubernetes API server, steal cluster credentials, and manipulate WebSocket or REST API traffic without triggering TLS errors.

Affected Products

maclof/kubernetes-client versions 0.17.0 through 0.31.0
PHP applications consuming kubeconfig files without certificate-authority-data
Workloads relying on the library to enforce insecure-skip-tls-verify: false

Discovery Timeline

2026-10-05 - CVE-2026-105223 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105223

Vulnerability Analysis

The library's kubeconfig parser controls whether Guzzle verifies the Kubernetes API server certificate through the $options['verify'] key. When certificate-authority-data is present, the parser writes the CA bundle to a temporary file and enables verification. When the field is absent, the vulnerable branch sets $options['verify'] = false for any https:// master URL, regardless of the explicit insecure-skip-tls-verify setting in the kubeconfig.

An attacker who can intercept traffic between the PHP client and the API server, such as through ARP spoofing, rogue Wi-Fi, or a compromised egress proxy, can present a self-signed certificate. The client accepts it without warning. Bearer tokens, Basic auth credentials, and request payloads flow through the attacker, who can also inject responses or hijack watch streams over WebSockets.

Root Cause

The root cause is improper certificate validation in src/Client.php. The conditional chain checks for certificate-authority-data first and then falls through to disable verification for all HTTPS endpoints. The insecure-skip-tls-verify key defined by the Kubernetes kubeconfig specification is never read. Clusters that distribute kubeconfigs relying on system trust stores receive unverified TLS by default.

Attack Vector

Exploitation requires network-adjacent positioning between the PHP application and the Kubernetes API server. No authentication or user interaction is required. Once in path, the attacker performs a standard TLS man-in-the-middle, capturing credentials sent in Authorization headers and relaying modified requests to the real API server.

php

// Vulnerable logic (pre-patch) vs. fixed logic in src/Client.php
// Source: https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b0948127609e99d0e6f34

if (isset($cluster['certificate-authority-data'])) {
    $options['ca_cert'] = self::getTempFilePath(
        'ca-cert.pem',
        base64_decode($cluster['certificate-authority-data'], true)
    );
-} elseif (strpos($options['master'], 'https://') !== false) {
+} elseif (($cluster['insecure-skip-tls-verify'] ?? false) === true) {
    $options['verify'] = false;
+} elseif (strpos($options['master'], 'https://') !== false) {
+    $options['verify'] = true;
}

The patch honors insecure-skip-tls-verify only when explicitly set to true and enables verification against the system trust store otherwise. See the GitHub Commit #924c0b9 for the full fix.

Detection Methods for CVE-2026-105223

Indicators of Compromise

Unexpected TLS certificates presented on connections to Kubernetes API server endpoints
Kubernetes audit log entries showing API requests originating from unfamiliar source IPs using valid service account tokens
Composer dependency manifests pinning maclof/kubernetes-client to any version between 0.17.0 and 0.31.0
Kubeconfig files lacking certificate-authority-data yet connecting over https://

Detection Strategies

Perform Software Composition Analysis across PHP repositories and container images to flag vulnerable maclof/kubernetes-client versions.
Inspect kubeconfig assets in CI/CD pipelines and secret stores for missing CA data combined with HTTPS master URLs.
Compare TLS certificate fingerprints observed on API server traffic against the known cluster CA to detect impersonation.

Monitoring Recommendations

Alert on Kubernetes API authentication events that occur from new network paths or unexpected egress IPs.
Monitor outbound TLS sessions from PHP workloads for unusual certificate chains or self-signed leaf certificates.
Track dependency updates in composer.lock files to confirm upgrades to 0.32.0 or later.

How to Mitigate CVE-2026-105223

Immediate Actions Required

Upgrade maclof/kubernetes-client to version 0.32.0 or later in all PHP applications.
Rotate any Kubernetes service account tokens, Bearer tokens, or Basic credentials that were used by vulnerable clients over untrusted networks.
Audit kubeconfig files and inject certificate-authority-data so TLS trust does not depend on the system store.

Patch Information

The fix is delivered in GitHub Release v0.32.0 via commit 924c0b9. The patch reorders the TLS decision logic in src/Client.php to honor insecure-skip-tls-verify and to enable verification by default for HTTPS endpoints. Refer to the VulnCheck Advisory for Kubernetes Client for additional vendor context and the originating GitHub Issue #135.

Workarounds

Embed the cluster CA as certificate-authority-data in every kubeconfig consumed by the library to force the verified code path.
Restrict PHP workloads to communicate with the Kubernetes API server over trusted, segmented networks until the upgrade is deployed.
Terminate API traffic through a service mesh or sidecar proxy that enforces mutual TLS and pins the API server certificate.

bash

# Upgrade the vulnerable dependency
composer require maclof/kubernetes-client:^0.32.0
composer update maclof/kubernetes-client

# Verify the installed version is no longer affected
composer show maclof/kubernetes-client | grep versions