CVE-2026-120656

None

CVSS

—

EPSS

0.2%

Published

Nov 2, 2026

CISA due date

—

The record

OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.

Affected packages

Ecosystem	Package	Introduced	Fixed