CVE-2026-43644
Description
podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Content-Type-Options headers. Attackers can craft cross-origin HTML pages with auto-submitting forms containing script payloads in the request body, which are served as text/html due to Go's content type detection, allowing the reflected script to execute in the podinfo origin context when victims visit the attacker's page.
How to fix
- github.com/stefanprodan/podinfo1.8.1-0.20260519111337-cbebb20fd485 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stefanprodan podinfo | v ≤ 6.11.12 | — |
| github.com/stefanprodan/podinfoGo | v < 1.8.1-0.20260519111337-cbebb20fd485 | 1.8.1-0.20260519111337-cbebb20fd485 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.