CVE-2026-22549 BIG-IP Container Ingress Services vulnerability

A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000157960: BIG-IP Container Ingress Services vulnerability CVE-2026-22549

Security Advisory Description A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. CVE-2026-22549 Impact A remote, authenticated attacker with high privilege access to BIG-IP Container Ingress Services may be able to read...

F5 BIG-IP Container Ingress Services 安全漏洞

F5 BIG-IP Container Ingress Services is a device management platform provided by the American company F5. F5 BIG-IP Container Ingress Services has security vulnerabilities, which stem from excessive permissions that may allow access to cluster keys...

PT-2026-6404

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

PT-2026-6107

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Container Ingress Services affected versions not specified Description A flaw exists in F5 BIG-IP Container Ingress Services that could permit excessive permissions, potentially allowing unauthorized access to read cluster secrets...

PT-2026-6445

A security issue was discovered in ingress-nginx. Tthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that in...

ALSA-2026:1905 Important: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyasn1: pyasn1: Denial of Service due to memory exhaustion from malform...

CVE-2026-24512 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note tha...

CVE-2026-24512 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note tha...

CVE-2026-1580 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2026-1580

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

CVE-2026-1580 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: step-issuer-fips, cert-manager-google-cas-issuer, opentelemetry-operator, opentelemetry-operator-fips, cert-manager-istio-csr-fips, aws-privateca-issuer, step-issuer, gitlab-operator-fips, cert-manager-webhook-pdns, gitlab-operator, cert-manager-openshift-routes-fips...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: vault-k8s, flux-notification-controller, sftpgo-plugin-auth, kapp-controller, kuberlr, ferretdb, rabbitmq-default-user-credential-updater, yace, sops, helm-docs, flux-image-automation-controller, crossplane-provider-aws-cloudformation, gitleaks, falcosidekick,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: dbmate, cosign, lvm-driver, rabbitmq-cluster-operator, crossplane-provider-aws-ec2, kustomize, helm-set-status, grpcurl, vault-k8s, kubernetes-dashboard, azure-workload-identity-webhook, mattermost, gptscript, flux-notification-controller, ytt, sftpgo-plugin-auth,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: pvc-autoresizer-fips, lvm-driver-fips, zabbix-agent2-fips, gatus-fips, longhorn-engine, kube-conformance, prometheus-beat-exporter-fips, consul-k8s-fips, livekit-cli, karpenter, crossplane-provider-aws-sns, ctop, kubernetes-csi-external-snapshotter,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: pvc-autoresizer-fips, lvm-driver-fips, zabbix-agent2-fips, gatus-fips, longhorn-engine, kube-conformance, prometheus-beat-exporter-fips, consul-k8s-fips, livekit-cli, karpenter, crossplane-provider-aws-sns, ctop, kubernetes-csi-external-snapshotter,...