CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, step, rancher-telemetry, ksops, sriov-network-device-plugin, goreleaser, kubernetes-dashboard-api, policy-controller, kubo, flux-image-automation-controller, headlamp, nri-f5, hubble-ui, aws-flb-cloudwatch, paranoia, external-dns, extism...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: rancher-telemetry, policy-controller, mage, redka, crane, aws-s3-controller, swagger, rootlesskit, metrics-server, tfsec, nri-prometheus, kubernetes-csi-driver-hostpath, kube-logging-operator-custom-runner, harbor, kustomize, spqr, docker-cli, kubernetes-replicator,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: vault-env, neuvector-sigstore-interface, rancher-telemetry, sriov-network-device-plugin, policy-controller, sigstore-scaffolding, mage, oauth2-proxy, azure-ipam, elvish, wireguard-go, extism, aws-signer-notation-plugin, dfc, redka, crane, timestamp-authority,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, velero-plugin-for-aws-fips, dragonfly-operator, timoni, mc-fips, mkcert, dex-k8s-authenticator, cluster-api-helm-controller-fips, kube-logging-operator-custom-runner-fips, distribution, prometheus-alertmanager-fips, knative-serving,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, velero-plugin-for-aws-fips, dragonfly-operator, timoni, mc-fips, mkcert, dex-k8s-authenticator, cluster-api-helm-controller-fips, kube-logging-operator-custom-runner-fips, distribution, prometheus-alertmanager-fips, knative-serving,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, velero-plugin-for-aws-fips, dragonfly-operator, timoni, mc-fips, mkcert, dex-k8s-authenticator, cluster-api-helm-controller-fips, kube-logging-operator-custom-runner-fips, distribution, prometheus-alertmanager-fips, knative-serving,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, velero-plugin-for-aws-fips, dragonfly-operator, timoni, mc-fips, dex-k8s-authenticator, cluster-api-helm-controller-fips, kube-logging-operator-custom-runner-fips, distribution, prometheus-alertmanager-fips, knative-serving,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, sqlexporter-fips, cluster-autoscaler-fips, dragonfly-operator, verticadb-operator-fips, yam, crossplane-provider-azure-managedidentity, kubernetes-csi-external-provisioner-fips, mkcert, cluster-api-helm-controller-fips, temporal,...