OpenKruise kruise‑manager exposes a pprof endpoint that is enabled by default when the feature is turned on. The service listens on 0.0.0.0:8090 and accepts requests without any form of authentication. As a result, any pod that has RBAC permissions can reach the endpoint and trigger a denial‑of‑service attack by overwhelming the manager process. The weakness is rooted in improper access control and lack of authentication for a public endpoint.

The affected component is the OpenKruise kruise‑manager, the main control plane module for OpenKruise. No specific version numbers are listed in the CVE data, but a release of version 1.9.2 includes a fix for this issue. Consequently, any installation of kruise‑manager that has the pprof endpoint enabled and is listening on a public interface is vulnerable.

Because the endpoint is publicly accessible and requires only RBAC pod privileges— a permissive condition in many Kubernetes clusters— an attacker can quickly trigger the DoS condition. No additional credentials or privileged escalation are necessary beyond existing pod RBAC rights. The exploit is straightforward: send a large number of profiling requests to 0.0.0.0:8090. The CVE does not provide an EPSS score or KEV listing, yet the lack of authentication represents a clear and actionable risk for any exposed environment.