polaris

Polaris 是 Kubernetes 的一个开源策略引擎 Polaris 是 Kubernetes 的一个开源策略引擎，用于验证和修复资源配置。它包含 30 多个内置配置策略，并支持使用 JSON Schema 构建自定义策略。当以命令行模式或作为突变 Webhook 运行时，Polaris 能够根据策略标准自动修复问题。 Polaris 可以在三种不同模式下运行： 作为仪表盘 - 根据策略即代码验证 Kubernetes 资源。 作为准入控制器 - 自动拒绝或修改不符合组织策略的工作负载。 作为命令行工具 - 将策略即代码集成到 CI/CD 流程中，用于测试本地 YAML 文件。...

IngressNightmare-PoC

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. Research by Wiz In the original research, the Wi...

CVE-2025-1974

Kubernetes Ingress-NGINX Ejecución remota de código no autenticada CVE-2025-1974 Ingress-NGINX: Controlador de ingreso para Kubernetes que utiliza NGINX como proxy inverso y balanceador de carga La vulnerabilidad "IngressNightmare" CVE-2025-1974 se origina en un defecto crítico en el Admission...

CVE-2025-1974

CVE-2025-1974 WhiteHat School 3.ª promoción - 김소은 @salt318 https://github.com/salt318/vulhub Resumen Se produce debido a una falla en el Ingress-NGINX Admission Controller, un mecanismo de seguridad fundamental de Kubernetes El Ingress-NGINX Admission Controller queda expuesto a la red sin...

IngressNightmare-RCE-POC

⚠️ RCE Crítica en Ingress-NGINX mediante Inyección de Configuración CVE-2025-1974 y más Este repositorio contiene un exploit de prueba de concepto PoC para CVE-2025-1974 , una vulnerabilidad Crítica CVSS 9.8 en el controlador Ingress-NGINX para Kubernetes. Esta falla permite la ejecución remota de...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Repositorio educativo centrado en Windows 11 para estudiar CVE-2025-1974 en un laboratorio seguro y no armamentizado de ATAQUE + DEFENSA. El proyecto está diseñado para trabajos universitarios, demostraciones en equipo y capturas de pantalla listas para...

CVE-2025-1974

演示 https://youtu.be/3hYlHeaf2mQ 什么是 CVE-2025-1974？ CVE-2025-1974 IngressNightmare 是 Kubernetes ingress-nginx 准入控制器中的一个严重（CVSS 9.8）未授权远程代码执行漏洞。 攻击流程： 1. 上传 ：通过 HTTP POST 向 NGINX 发送恶意共享库（.so 文件） 2. 注入 ：发送精心构造的 Ingress 相关清单（AdmissionReview），并携带注入 sslengine 指令的注解 3. 执行 ：准入控制器执行 nginx -t，该命令加载并执行恶意 .s...

CVE-2025-1974

🚨 通过 Ingress-NGINX 准入控制器进行日志注入测试 🧠 概述 此脚本用于测试 Kubernetes 集群中 NGINX Ingress 控制器的注解注入漏洞。它仅用于检测目的 ，涉及 CVE-2025-1974，该漏洞允许恶意注解影响 NGINX 配置。 📚 背景 该漏洞由 Wiz.io 披露（博客文章），涉及控制器未正确处理注入的注解。例如： root@kitploit: nginx.ingress.kubernetes.io/auth-url: "http://placeholder/; errorlog /root/thispathshouldntexist.log...

trivy-enforcer

trivy-enforcer EXPERIMENTAL Operador de Kubernetes para el aseguramiento de imágenes Funciona como Controlador de admisión Evita que se desplieguen imágenes inseguras Controlador personalizado Observa el CRD ImageVulnerability y escanea la imagen en el recurso personalizado automáticamente...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Bypass del controlador de admisión de Kubernetes mediante sensibilidad a mayúsculas y minúsculas Código del programa webhook de admisión en Python + exploit root@kitploit: !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flas...

CVE-2026-54523

A flaw was found in Kyverno, a policy engine for cloud-native platforms. A user with specific permissions to create policy objects in one area namespace can exploit a vulnerability where a namespace argument is not properly checked. This allows them to force the system's admission controller, whi...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

PT-2026-84158

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

GO-2026-5268 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

Authorization Bypass

Kyverno is vulnerable to Authorization Bypass. The vulnerability is due to a critical authorization boundary bypass in namespaced Kyverno Policy apiCall, where the resolved urlPath is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited t...

BIT-KYVERNO-2026-41485 Kyverno Controller Denial of Service via forEach Mutation Panic

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...