Kubernetes · Report #808169
Blind SSRF on velodrome.canary.k8s.io
Validstatus
lowseverity
16upvotes
7 Jan 2021disclosed
Summary
A blind server-side request forgery (SSRF) was found at the endpoint http://velodrome.canary.k8s.io/api/snapshots via a JSON parameter. An attacker can force the host to make a request to arbitrary URLs.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.