CVE-2026-75924 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

CVE-2026-75924

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

PT-2026-77215

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

CVE-2026-66795 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

CVE-2026-66795

The managedcluster-import-controller's CSR auto-approver skips validation of signer name, certificate subject, and requester identity, letting a privileged spoke-cluster service account submit a malicious CSR and escalate to hub-cluster admin. CVSS 9.1 critical; no exploitation evidence provided....

CVE-2026-66795: Improper Certificate Validation

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request CSR auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a...

PT-2026-76789

Name of the Vulnerable Software and Affected Versions managedcluster-import-controller affected versions not specified Description The managedcluster-import-controller contains a flaw in its Certificate Signing Request CSR auto-approval logic. The system fails to properly validate incoming CSRs...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr, istio...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr-fips, cert-manager-istio-csr...

GO-2026-5289 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-istio-csr, step-issuer, cert-manager-webhook-pdns, aws-privateca-issuer, cert-exporter...

GO-2026-4399 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cert-manager-istio-csr, step-issuer, cert-manager-webhook-pdns, aws-privateca-issuer, opentelemetry-operator, percona-server-mongodb-operator, mariadb-operator, cert-manager-csi-driver...

GO-2026-5543 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, harbor, ratify, rclone, kyverno, kyverno-notation-aws, terraform, percona-server-mongodb-operator, spqr, nuclei, rancher-agent, seaweedfs, sftpgo-plugin-auth, k6, telegraf, dex, frp, opentofu, bento, openbao, gitlab-runner, zot, grafana, juicefs,...

GO-2026-4958 vulnerabilities

Vulnerabilities for packages: verticadb-operator, kwok, trivy-operator, kubescape, percona-server-mongodb-operator, headlamp, velero, consul-k8s, datadog-agent, vcluster, rancher-agent, kubernetes-dashboard-api, linkerd2, rancher-fleet, cloudnative-pg, dynamic-localpv-provisioner, gitlab-kas,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-pubsub, harbor-registry, verticadb-operator, fluxcd-kustomize-mutating-webhook, kuberay-operator, newrelic-fluent-bit-output, ctop, kubernetes-csi-driver-nfs, nats-top, ratify, aws-sigv4-proxy, azure-service-operator, x509-certificate-exporter, terrafor...

GO-2025-3485 vulnerabilities

Vulnerabilities for packages: flyte, harbor-registry, step-issuer, timestamp-authority, ko, goreleaser, undock, guac, buildah, step, tekton-chains, frp, falcoctl, melange, temporal-ui-server, trivy, zot, vexctl, vault-benchmark, kargo, dagdotdev, distribution, grafana-alloy,...

Malicious Package

Overview discord-csr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

MAL-2026-11277 Malicious code in discord-csr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830c0ff21018fcfee625d241dece766b6c8db87e891ba9fbcfe567a01ec1447c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-csr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830c0ff21018fcfee625d241dece766b6c8db87e891ba9fbcfe567a01ec1447c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...