CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: sbomqs, metacontroller, osv-scanner, vault-benchmark, actions-runner-controller, crossplane-provider-aws-sns, container-object-storage-interface, crossplane-provider-aws-cloudfront, stakater-reloader, calico, terraform-mcp-server, authservice, octo-sts, croc,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: contour, pulumi-language-java, licenseclassifier, protoc-gen-go-grpc, kbld, terraform-provider-random, cue, custom-pod-autoscaler-operator, cadvisor, dagdotdev, kube-logging-operator, aws-s3-controller, step-kms-plugin, cloud-provider-vsphere, wire-go, glow, gops,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis, kapp, kbld,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: stern, metacontroller, configmap-reload, contour, docker-credential-acr-env, container-object-storage-interface, stakater-reloader, licenseclassifier, velero-plugin-for-csi, kratos, controller-gen, octo-sts, cri-tools, wait-for-port, prometheus-alertmanager, atlantis...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: mongo-tools, crossplane-function-environment-configs, conftest-fips, pvc-autoresizer, terraform-provider-azapi, kubecolor, packer, docker-cli-buildx, node-problem-detector, grafana-pyroscope, openbao-k8s, src-fingerprint, gcp-compute-persistent-disk-csi-driver-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: mongo-tools, crossplane-function-environment-configs, conftest-fips, pvc-autoresizer, terraform-provider-azapi, kubecolor, packer, docker-cli-buildx, node-problem-detector, grafana-pyroscope, openbao-k8s, src-fingerprint, gcp-compute-persistent-disk-csi-driver-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: mongo-tools, crossplane-function-environment-configs, conftest-fips, pvc-autoresizer, terraform-provider-azapi, kubecolor, packer, docker-cli-buildx, node-problem-detector, grafana-pyroscope, openbao-k8s, src-fingerprint, gcp-compute-persistent-disk-csi-driver-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: mongo-tools, crossplane-function-environment-configs, conftest-fips, pvc-autoresizer, terraform-provider-azapi, kubecolor, packer, docker-cli-buildx, node-problem-detector, grafana-pyroscope, openbao-k8s, src-fingerprint, gcp-compute-persistent-disk-csi-driver-fips,...