47 matches found
CVE-2026-113672
A flaw was found in Argo CD. When processing Jsonnet files, the application does not restrict file imports to the intended repository, allowing files outside of it to be read. This can lead to disclosure of sensitive information, such as credentials and access tokens, and may also result in a...
CVE-2026-113672
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...
CVE-2026-113672
The repo-server component in Argo CD (versions 0.9.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2) is vulnerable to a path traversal and arbitrary file read issue. The underlying cause is an importer that fails to confine import, importstr, or importbin operations to the repository root when eval...
EUVD-2026-105227
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...
CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...
warcannon
WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...
SUSE CVE-2026-11769
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...
CVE-2026-11769
A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...
GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...
GHSA-FCW4-WWQM-M8CF Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templatin...
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templatin...
CVE-2026-11769
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...
Credential Exposure
Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...
CVE-2026-11769 Operator - Namespaced User Path Traversal
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...
CVE-2026-11769 Operator - Namespaced User Path Traversal
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...
CVE-2026-11769: Improper Limitation of a Pathname to a Restricted Directory
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...
Operator - Namespaced User Path Traversal
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language...
CVE-2025-61731 vulnerabilities
Vulnerabilities for packages: flux-notification-controller, crossplane-provider-aws-firehose, age, ratify, kubernetes-dashboard-metrics-scraper, opensearch-k8s-operator, kubernetes-csi-external-provisioner, yunikorn-k8shim, crossplane-provider-aws-ec2, cloud-provider-aws, go-licenses,...
GHSA-XVQR-69V8-F3GV vulnerabilities
Vulnerabilities for packages: flux-notification-controller, crossplane-provider-aws-firehose, age, ratify, kubernetes-dashboard-metrics-scraper, opensearch-k8s-operator, kubernetes-csi-external-provisioner, yunikorn-k8shim, crossplane-provider-aws-ec2, cloud-provider-aws, go-licenses,...
CVE-2025-68119 vulnerabilities
Vulnerabilities for packages: flux-notification-controller, crossplane-provider-aws-firehose, age, ratify, kubernetes-dashboard-metrics-scraper, opensearch-k8s-operator, kubernetes-csi-external-provisioner, yunikorn-k8shim, crossplane-provider-aws-ec2, cloud-provider-aws, go-licenses,...