CVE-2026-120656

— UNSCOREDpublic exploit available

Published 2026-11-02 · Updated 2026-11-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.

Public exploit & PoC references

https://github.com/openkruise/kruise/pull/2613
https://github.com/openkruise/kruise/releases/tag/v1.9.2
https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md

All references

https://github.com/openkruise/kruise/pull/2613
https://github.com/openkruise/kruise/releases/tag/v1.9.2
https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.