GO-2026-6094 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, cluster-api-azure-controller, datadog-agent, argocd-image-updater, gitlab-kas, cluster-api-gcp-controller, rancher-agent, tkn, kyverno-notation-aws, telegraf, kube-metrics-adapter, metrics-server, cluster-api, fluent-operator, cloud-provider-azure,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: aactl, kubernetes-dashboard-web, dive, cilium-cli, thanos-operator, k8sgateway, kubecolor, kapp, trivy, wait-for-port, nri-consul, kubeflow-katib, nri-apache, swagger, src, helm-operator, regclient, opa, neuvector-sigstore-interface, ratify, emissary, kuberlr,...

GO-2026-5615 CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3

CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3...

CVE-2026-47190

A flaw was found in the Cluster API Provider Metal3 IP Address Manager IPAM controller. The controller's ClusterRole granted excessive permissions, allowing full create, read, update, and delete CRUD access to core/v1 Secrets. If the controller pod were compromised, an attacker could leverage the...

CVE-2026-47190: Execution with Unnecessary Privileges

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

PT-2026-45027

Name of the Vulnerable Software and Affected Versions IPAM versions prior to 1.11.7 IPAM versions prior to 1.12.4 IPAM versions prior to 1.13.0 Description The IPAM controller's ClusterRole grants excessive CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets, despi...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: rekor, deck, shfmt, supercronic, apisix-ingress-controller, crossplane-provider-family-aws-fips, falco-exporter, kyverno-fips, generic-device-plugin, dgraph, terraform-provider-time, guac, flux-source-controller, crossplane-provider-aws-lambda-fips, nri-kafka-fips,...