CVE-2025-9708 — Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks

Description (CNA)

A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.

Affected (CNA)

Vendor / product	Versions
Kubernetes / Kubernetes CSharp Client	affected 0 through 17.0.13; unaffected 17.0.14

CWE

CWE-295

References

https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ
https://github.com/kubernetes/kubernetes/issues/134063

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/09/16/1