Kubernetes C# Client Flaw Exposes API to MITM Attacks (CVE-2025-9708)

A newly disclosed vulnerability in the Kubernetes C# client has been assigned CVE-2025-9708 with a CVSS score of 6.8 (Medium severity) and stems from improper certificate validation in custom Certificate Authority mode, creating the risk of man-in-the-middle attacks and API impersonation.

According to the advisory, the certificate validation logic accepts properly constructed certificates from any Certificate Authority without properly verifying the trust chain, allowing a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server.

The issue affects all versions prior to v17.0.14, and the vulnerability could enable MITM attacks and API server impersonation, especially where connections to a Kubernetes API server over TLS/HTTPS use custom CA certificates in kubeconfig on untrusted networks.

The vulnerability has been patched in Kubernetes C# client v17.0.14 and above, and organisations are urged to upgrade as soon as possible; temporary mitigations include moving CA certificates into the system trust store or disabling the custom CA in kubeconfig and adding the CA to the machine’s trusted root store.