{"affected":[{"product":"kruise-manager","source":"CNA: certcc","vendor":"OpenKruise","versions":[{"lessThanOrEqual":"1.9.2","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120656","cwes":["CWE-400"],"description":"OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793645074399,"publishedAt":1793645074399,"references":[{"source":"CNA: certcc","tags":[],"url":"https://github.com/openkruise/kruise/pull/2613"},{"source":"CNA: certcc","tags":[],"url":"https://github.com/openkruise/kruise/releases/tag/v1.9.2"},{"source":"CNA: certcc","tags":[],"url":"https://github.com/tommitelman-orca/advisories/blob/main/openkruise-pprof-2026.md"}],"remediation":[],"revision":"704d9e41412384c7d27cebe45e8dcdbfd8adc326eb8db770e45158cc68589f04","sources":[{"modifiedAt":1793645074399,"name":"CNA: certcc","retrievedAt":1793646543076,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120656"}],"ssvc":null,"status":"published","title":"CVE-2026-120656","updatedAt":1793646543076}