peirates

Peirates Peiratesとは？ PeiratesはKubernetesペネトレーションツールであり、攻撃者がKubernetesクラスタ内で権限を昇格し、横展開することを可能にします。サービスアカウントトークンやシークレットの窃取と収集、さらなるコード実行の取得、クラスタの制御奪取といった既知の手法を自動化します。 Peiratesはどこで実行しますか？ PeiratesはKubernetes上で動作するコンテナ内から、またはコンテナ外のKubernetesノードから実行します。 PeiratesはKubernetesクラスタを攻撃しますか？...

IngressNightmare-PoC

Ingress NGINX - IngressNightmare 向けエクスプロイト このプロジェクトは、IngressNightmare と総称される、Kubernetes の Ingress NGINX Controller における重大な 認証なしリモートコード実行 RCE の脆弱性を標的としたエクスプロイトを提供します。（Wiz による研究） 元の研究では、Wiz チームは PoC や実用的なエクスプロイトを公開していなかったため、私たち自身で作成し、コミュニティと共有することにしました。 概要 Ingress NGINX Controller は Kubernetes...

CVE-2025-1974

CVE-2025-1974 — IngressNightmare ingress-nginx 引言 本文档介绍了影响 Kubernetes 组件 ingress-nginx （验证准入控制器）的漏洞 CVE-2025-1974 的研究。 CVE-2025-1974 是一个严重漏洞（CVSS 3.1 9.8 ），属于 ingress-nginx 进程上下文中的未经身份验证的 远程代码执行（RCE） 。攻击者在攻击过程中，如果能够访问 Pod 网络（或者能够将 AdmissionReview 发送到验证 webhook），则可以在控制器 Pod 中执行任意代码，这可能导致 Secrets...

CVE-2026-61549

Woodpecker CI/CD engine (Kubernetes backend) contains a privilege escalation vulnerability in versions 1.0.0 through 3.15.0 . The backend_options.kubernetes.serviceAccountName field in pipeline/backend/kubernetes/pod.go is copied directly into the pod spec without administrator authorization. Any...

GHSA-2J95-GQXF-V3VG Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

SUSE CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

PT-2026-84158

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-60585

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

PT-2026-60111

Name of the Vulnerable Software and Affected Versions Woodpecker CI versions v1.0.0 through v3.15.0 Description A privilege escalation issue exists in instances using the Kubernetes backend. The pipeline option backend options.kubernetes.serviceAccountName is passed directly to the pod spec witho...

GO-2026-5860 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover in github.com/fission/fission...

Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Summary A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. Details Three independent flaws compounded: 1. Validate gap...

GHSA-WMGG-3P4H-48X7 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Summary A stronger framing of the same root cause as GHSA-gx55-f84r-v3r7: the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. Details Three independent flaws compounded: 1. Validate gap...

PT-2026-51305

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 affected versions not specified Description A flaw exists in the Windows Machine Config Operator WMCO where the WICD CSR auto-approver validates that a Certificate Signing Request contains the organizatio...

CVE-2026-50545 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous...

CVE-2026-50545 Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous...

CVE-2026-50545

Fission (Kubernetes-native serverless) prior to version 1.24.0 allowed Environment.spec.runtime.podSpec and spec.builder.podSpec passthrough without validation, and MergePodSpec could propagate dangerous fields into generated pods. This CVE—CVE-2026-50545—describes a PodSpec injection with potent...

PT-2026-36199

Name of the Vulnerable Software and Affected Versions IBM Turbonomic prometurbo agent versions 8.16.0 through 8.17.6 Description IBM Turbonomic Application Resource Management grants excessive cluster-wide permissions, which include unrestricted read access to all secrets. An attacker who...