Unrated severityNVD Advisory· Published Nov 2, 2026· Updated Nov 2, 2026

CVE-2026-120656

Description

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.

Affected products

Openkruise/kruise-managerllm-create
Openkruise/Kruisellm-fuzzy

Patches

Vulnerability mechanics

References

github.com/openkruise/kruise/pull/2613nvd
github.com/openkruise/kruise/releases/tag/v1.9.2nvd
github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000