AIKIDO-2026-499664

TL;DR

parseKubeconfig() and parseKubeconfigFile() build the HTTP client options used to talk to the Kubernetes API server from a supplied kubeconfig. When the kubeconfig omits certificate-authority-data, the client disables TLS certificate verification and ignores an explicit insecure-skip-tls-verify: false setting. An on-path party between the client and the API server can impersonate the server, capture Bearer tokens or Basic credentials, and tamper with REST or WebSocket traffic. The fix defaults certificate verification to enabled and only disables it when the kubeconfig explicitly requests it.