ALPINE-CVE-2026-86409

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

CVE-2026-86409

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the process of reusing transfer handles across different trust boundaries and attempting to clear AWS SigV4 authentication by resetting the option to null. An attacker can obtain acce...

curl: curl: stale SigV4 headers sent unintended

A flaw was found in curl. When an application attempts to disable Amazon Web Services Signature Version 4 AWS SigV4 authentication on a reused connection handle, curl fails to clear the setting as expected. If the application subsequently directs a request to an untrusted or attacker-controlled...

CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, crossplane-provider-azure-sql, azcopy, nri-postgresql, newrelic-nri-statsd, sbomqs, crossplane-provider-aws-elasticache, thanos-operator, nri-nginx, cloud-provider-aws, bank-vaults, pvc-autoresizer, sops, rancher-system-agent, opentofu,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: gobump, direnv, harbor-registry, cfssl, kube-logging-operator, docker-cli-buildx, mongodb-kubernetes-operator, trivy-operator, timoni, controller-gen, grpcurl, skaffold, glow, falco-no-driver, octo-sts, incert, terraform-provider-azuread, gotestsum, php-fpmexporter,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry, atlantis, cfssl,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry, atlantis,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry, atlantis,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: hivemind, vexctl, gobump, direnv, velero-plugin-for-aws, newrelic-nri-statsd, thanos-operator, docker-machine-driver-harvester, falco-exporter, nri-prometheus, pvc-autoresizer, licenseclassifier, age, sops, rancher-system-agent, opentofu, hydra, harbor-registry,...