CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: cilium-cli, lvm-driver, hubble, opentelemetry-collector, secrets-store-csi-driver-provider-azure, consul-k8s, gitaly, dagger, apko, minify, mesosphere-vsphere-csi, argo-workflows, cert-manager-csi-driver, metacontroller, redpanda, runc, zot, minio-operator, dex,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: cilium-cli, lvm-driver, hubble, shfmt, opentelemetry-collector, secrets-store-csi-driver-provider-azure, consul-k8s, gitaly, dagger, apko, minify, mesosphere-vsphere-csi, argo-workflows, cert-manager-csi-driver, ini-file, metacontroller, redpanda, runc, zot,...

CVE-2026-42499 vulnerabilities

Vulnerabilities for packages: cilium-cli, hubble, runc, zot, minio-object-browser, kyverno, istio, flux, falco-no-driver, cilium, pgtimetable, minio, k8ssandra-client, helm-operator, kaf, buildah, kubernetes-dashboard, slsa-verifier, k3s, grafana-alloy, tkn, aws-flb-cloudwatch, rancher-webhook,...

GHSA-P9H5-JM8X-MJM5 vulnerabilities

Vulnerabilities for packages: cilium-cli, hubble, runc, zot, minio-object-browser, kyverno, istio, flux, falco-no-driver, cilium, pgtimetable, minio, k8ssandra-client, helm-operator, kaf, buildah, kubernetes-dashboard, slsa-verifier, k3s, grafana-alloy, tkn, aws-flb-cloudwatch, rancher-webhook,...

CVE-2026-39823 vulnerabilities

Vulnerabilities for packages: cilium-cli, lvm-driver, hubble, secrets-store-csi-driver-provider-azure, gitaly, dagger, apko, mesosphere-vsphere-csi, argo-workflows, cert-manager-csi-driver, runc, redpanda, zot, dex, dbmate, minio-object-browser, kyverno, istio, flux, litestream, cloud-sql-proxy,...

CVE-2026-39820 vulnerabilities

Vulnerabilities for packages: cilium-cli, hubble, runc, zot, minio-object-browser, kyverno, istio, flux, falco-no-driver, cilium, pgtimetable, minio, k8ssandra-client, helm-operator, kaf, buildah, kubernetes-dashboard, slsa-verifier, k3s, grafana-alloy, tkn, aws-flb-cloudwatch, rancher-webhook,...

GHSA-XQ5J-9R39-C3VF vulnerabilities

Vulnerabilities for packages: cilium-cli, hubble, runc, zot, minio-object-browser, kyverno, istio, flux, falco-no-driver, cilium, pgtimetable, minio, k8ssandra-client, helm-operator, kaf, buildah, kubernetes-dashboard, slsa-verifier, k3s, grafana-alloy, tkn, aws-flb-cloudwatch, rancher-webhook,...

GHSA-8WXP-XXP2-RCGX Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook...

Volcano's webhook server vulnerable to OOM due to unbounded HTTP request body size

Impact The Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the webhook...

📄 Apache Airflow Databricks Provider Certificate Verification Bypass

The Apache Airflow Databricks Provider package disables TLS certificate verification when communicating with the Kubernetes API server during federated token exchange. Both the synchronous and asynchronous code paths use verify=False / ssl=False, allowing any attacker with network access within t...

ingress-nginx Configuration Injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

PT-2026-39242

Name of the Vulnerable Software and Affected Versions Volcano versions prior to 1.14.2 Volcano versions prior to 1.13.3 Volcano versions prior to 1.12.4 Description The Volcano webhook server fails to enforce a size limit on incoming HTTP request bodies. This allows any in-cluster pod capable of...

PAN-OS RCE Exploit Under Active Use Enabling Root Access and Espionage

Palo Alto Networks has disclosed that threat actors may have attempted to unsuccessfully exploit a recently disclosed critical security flaw as early as April 9, 2026. The vulnerability in question is CVE-2026-0300 CVSS score: 9.3/8.7, a buffer overflow vulnerability in the User-ID Authentication...

RLSA-2026:13917 Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion...

mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq()

...

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through lib/builtin.js. An attacker can execute host code when the allowlist includes -X or uses and then calls...

GHSA-V8J7-HP7C-738F Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

Summary Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to the user's dashboard and read their Kubernetes logs in real time. Thi...

SUSE CVE-2026-43271

In the Linux kernel, the following vulnerability has been resolved: md-cluster: fix NULL pointer dereference in processmetadataupdate The function processmetadataupdate blindly dereferences the 'thread' pointer acquired via rcudereferenceprotected within the waitevent macro. While the code commen...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the compressedEndpoint field in a UIPlugin deployment. An attacker can overwrite binaries or configuration files, tamper with cluster state, or write to the host node filesystem by exploiting path traversal in th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the compressedEndpoint field in a UIPlugin deployment. An attacker can overwrite binaries or configuration files, tamper with cluster state, or write to the host node filesystem by exploiting path traversal in th...