maclof kubernetes-client: Missing TLS certificate verification for Kubernetes API
Summary
The PHP library maclof kubernetes-client from version 0.17.0 before 0.32.0 disables TLS certificate verification when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. An attacker positioned on the network path between the application and the Kubernetes API server can impersonate the API server. This allows capture of Bearer tokens or Basic credentials and manipulation of WebSocket and REST API traffic.
Affected
- maclof kubernetes-client 0.17.0 to before 0.32.0
- Default configuration is not affected; the flaw occurs when a kubeconfig lacks certificate-authority-data
Fixed in
- Upgrade to version 0.32.0 or later (check 0.33.0 before choosing a target version)
Workaround
- Unknown. No vendor-published workaround.
- Unverified inference: ensure kubeconfig files include certificate-authority-data and review how the application builds its HTTP client, until the upgrade is done. Test in a lab first.
Exploitation
- Not listed as known exploited (KEV: No).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found; this is not confirmation that none exists.
Our recommendation
- Check composer.lock files and deployed container images for maclof/kubernetes-client.
- Upgrade affected installations to 0.32.0 or later.
- Ensure kubeconfig files contain CA data and that cluster traffic does not cross untrusted networks.
- Review the RBAC scope of credentials used by the affected application.
- Prioritise systems that run this library in production on shared or untrusted networks.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: maclof kubernetes-client repository github.com
- Vulnerable code in 0.31.0 (Client.php) github.com
- Fix commit 924c0b9 github.com
- Release 0.32.0 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-105223 osv.dev
- Packagist package maclof/kubernetes-client packagist.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:31.
Original description (NVD)
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
NVD references (6)
- https://github.com/maclof/kubernetes-client
- https://github.com/maclof/kubernetes-client/blob/0.31.0/src/Client.php#L309-L312
- https://github.com/maclof/kubernetes-client/commit/924c0b935fa538ed6b4b0948127609e99d0e6f34
- https://github.com/maclof/kubernetes-client/issues/135
- https://github.com/maclof/kubernetes-client/releases/tag/0.32.0
- https://www.vulncheck.com/advisories/maclof-kubernetes-client-0.17.0-before-0.32.0-disabled-tls-certificate-v…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.