podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.
References
| Link | Resource |
|---|---|
| https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md | Exploit Mitigation Third Party Advisory |
| https://github.com/stefanprodan/podinfo/issues/474 | Issue Tracking |
| https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint | Third Party Advisory |
Configurations
History
01 Jun 2026, 13:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Stefanprodan
Stefanprodan podinfo |
|
| References | () https://github.com/Niccolo10/Security-Advisories/blob/main/CVE-2026-43644/cve-2026-43644.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://github.com/stefanprodan/podinfo/issues/474 - Issue Tracking | |
| References | () https://www.vulncheck.com/advisories/podinfo-reflected-xss-via-echo-endpoint - Third Party Advisory | |
| CPE | cpe:2.3:a:stefanprodan:podinfo:*:*:*:*:*:kubernetes:*:* |
14 May 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-14 13:16
Updated : 2026-06-01 13:48
NVD link : CVE-2026-43644
Mitre link : CVE-2026-43644
CVE.ORG link : CVE-2026-43644
JSON object : View
Products Affected
stefanprodan
- podinfo
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')