Kubernetes C# Client Flaw Exposes API Server to MiTM Attacks

A recently disclosed vulnerability in the Kubernetes C# client library allows attackers to carry out man-in-the-middle (MiTM) attacks against the API server. The flaw arises from improper certificate validation when using custom certificate authorities (CAs), with the library accepting any certificate signed by the configured CA without verifying intermediate certificates or revocation status. The CVE identified is CVE-2025-9708, and the CVSS v3.1 score is 6.8.

All versions of the Kubernetes C# client prior to v17.0.14 are affected when configured with a custom CA in the kubeconfig file, posing a particular risk on untrusted networks such as public or compromised environments. To address the issue, users are advised to upgrade to version 17.0.14 or later; as an interim measure, moving custom CA certificates into the operating system’s trusted root store and disabling the client’s custom CA mode can reduce exposure.

The flaw was disclosed by the researchers and has been addressed by a release that enforces full chain verification and rejection of untrusted certificates.