CVE-2025-9708
Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
- Record
CVE-2025-9708- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2025-29657
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
- Record
EUVD-2025-29657- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w7r3-mgwf-4mqq
Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
- Record
GHSA-w7r3-mgwf-4mqq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
- Record
CVE-2025-9708- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVGHSA-w7r3-mgwf-4mqq
Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain
A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.
- Record
GHSA-w7r3-mgwf-4mqq- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
KubernetesClientNuGet |
before 17.0.14 | 17.0.14 |
KubernetesClientNuGet |
before 17.0.14, plus listed versions 0.1.0-beta0.2.0-beta0.3.0-beta0.4.0-beta0.5.0-beta Show 45 moreShow less0.6.0-beta0.7.0-beta0.7.0-beta-g6728505e340.8.0-beta0.8.0-beta-g307c77bf041.0.01.0.0-g86abfc1b7c1.0.0-g9253eeb2eb1.0.0-ge6c11774711.1.0-g49bb82b15d1.1.0-g6e0aec994e1.1.0-g6eb55551451.1.0-g7723604b7e1.1.0-ga358cb9afd1.1.0-gbc1cb6205c1.1.0-gc1543b527e1.1.0-gf488d54ce71.1.10-gbb11e5f5ce1.1.11-g3f698207391.1.12-gd01446718d1.1.13-g8c3152af971.1.14-gdae6d62cba1.2.01.2.1-gaec5c991621.2.2-gac99f43c841.2.3-g3551f032581.2.4-g722d4e09d31.2.5-g397a582ff01.2.6-g3cee7fbd931.2.7-g09a8c8773a1.2.8-g9372e3291f1.3.1-gdf3381607a1.3.2-g99dc2f7aaf1.3.3-g25523d19851.3.4-gaa1c8803011.3.5-g0b1669d5a51.3.6-g355d4a39271.3.7-g7c9cc88d381.3.8-g6bc54a68c41.3.9-gb7f79c924f1.4.1-g1600e44b001.4.1-g7e907d7c6f1.4.11-g406df57f9d1.4.12-ge95e01c6e91.4.13-g948d78c1bd |
17.0.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9708 is a medium vulnerability (CVSS 6.8) in Kubernetes Csharp Client, published September 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in KubernetesClient 17.0.14.
References
Left out here: 234 versions. The JSON record has them.