TLS Verification Bypass in maclof kubernetes-client

The maclof kubernetes-client library (versions 0.17.0 through 0.31.x) contains a critical security flaw in the parseKubeconfig() and parseKubeconfigFile() functions. When a provided kubeconfig file lacks certificate-authority-data, the library fails to enforce TLS certificate verification, regardless of the insecure-skip-tls-verify setting. This behavior results in the library trusting any certificate presented by a remote server. An on-path attacker, such as a malicious actor on the local network or an upstream ISP, can perform a man-in-the-middle attack to intercept the connection between the application and the Kubernetes API server. This exposure allows for the theft of sensitive Bearer tokens or Basic authentication credentials and facilitates the manipulation of REST API or WebSocket traffic, potentially leading to unauthorized cluster control.

Impact

Successful exploitation allows for the interception of authentication secrets and full compromise of the communication channel between the client application and the Kubernetes API server. This can result in unauthorized access, data exfiltration, or modification of Kubernetes resources depending on the privileges of the compromised credentials.

Recommendation

Update the maclof kubernetes-client library to version 0.32.0 or later immediately to resolve the improper certificate validation logic. Audit all applications utilizing this library to identify existing instances that rely on kubeconfig files lacking certificate-authority-data.