CVE-2026-15228

Kong Kubernetes Ingress Controller (KIC) is affected by CVE-2026-15228: a user with namespace-scoped Secret creation privileges can trigger a cluster-wide Denial of Service in ingress configuration. KIC collects CA-certificate Secrets across all watched namespaces using a label selector with no i...

CVE-2026-15228 Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

CVE-2026-15228 Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

PT-2026-65826

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

CVE-2026-48025

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...

EUVD-2026-49931

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...

CVE-2026-49258: Authorization Bypass Through User-Controlled Key

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

CVE-2026-17039: Incorrect Authorization

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...

PT-2026-63471

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This failure in...

Improper Certificate Validation

kumactl is vulnerable to Improper Certificate Validation. The vulnerability is due to TLS certificate verification being disabled when an HTTPS control plane profile is configured without a CA certificate, which allows an attacker to perform a man-in-the-middle attack and intercept API tokens...

GHSA-WVMP-6R4V-J6CV kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...

kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ca-certificates: ca-certificates-2025.2.80v9.0.304-9.hum1 noarch ca-certificates-bundle-2025.2.80v9.0.304-9.hum1 noarch ca-certificates-2025.2.80v9.0.304-9.hum1.src src...

ca-certificates: ca-certificates: Failure to remove TrustCor root certificates

A flaw was found in the ca-certificates package. This issue prevents the proper removal of certain TrustCor root certificates from the root store. A remote attacker could potentially exploit this vulnerability to leverage these unremoved certificates, leading to a compromise of data integrity. Th...

Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2026-1899)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1899 advisory. If the certificate auto-enrollment GPO is enabled on domain membersboth in Samba's smb.conf and using Windows GPME tool, a CAcertificate may be fetched using a plain HTTP connection and installedin the...

erlang: Erlang OTP public_key: Certificate chain forgery via improper trust chain validation

A flaw was found in Erlang OTP's publickey module. This vulnerability CWE-295, related to improper certificate validation, allows a non-Certificate Authority CA certificate to be accepted as an intermediate issuer. A remote attacker, holding an end-entity certificate issued by a trusted CA, can...

JLSEC-2026-696 Certificates with wildcard DNS SANs (e.g

Certificates with wildcard DNS SANs e.g. .example.com bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the issuing CA's permitted/excluded DNS name constraints could be accepted...

GHSA-CM26-5974-52H8 nebula-mesh: Certificate revocation is never enforced at the mesh

Summary nebula-mesh revokes a host by adding its certificate fingerprint to a per-CA blocklist and shipping that list to every other agent on each poll. Slack's Nebula enforces certificate revocation ONLY through the pki.blocklist list in config.yml no CRL/OCSP. The project's own code states this...

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Impact The web handler renderMobileBundle internal/web/handlers.go:1325 passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build internal/mobilebundle/builder.go:54, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build never calls...