CVE-2025-26628 Azure Local Cluster Information Disclosure Vulnerability

...

CVE-2025-25002

CVE-2025-25002 affects Azure Local Cluster and involves insertion of sensitive information into log files, enabling an authorized attacker to disclose data over an adjacent network. The connected documents confirm the Azure Local Cluster as the vulnerable component and describe the impact as data...

CVE-2025-25002 Azure Local Cluster Information Disclosure Vulnerability

...

Azure Local Cluster Information Disclosure Vulnerability

Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally...

Azure Local Cluster Information Disclosure Vulnerability

Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network...

PT-2025-15491 · Microsoft · Azure Local Cluster

Name of the Vulnerable Software and Affected Versions: Azure Local Cluster affected versions not specified Description: The issue allows an authorized attacker to disclose sensitive information over an adjacent network by inserting it into a log file in an Azure Local Cluster. This can potentiall...

The vulnerability of Kubernets Rancher cluster management software, related to deficiencies in access control, allows a hacker to change administrator passwords and gain access to their accounts.

The vulnerability of Kubernets Rancher cluster management software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to change administrator passwords and gain access to their accounts...

CERT-UA Reports Cyberattacks Targeting Ukrainian State Systems with WRECKSTEEL Malware

The Computer Emergency Response Team of Ukraine CERT-UA has revealed that no less than three cyber attacks were recorded against state administration bodies and critical infrastructure facilities in the country with an aim to steal sensitive data. The campaign, the agency said, involved the use o...

Kubernetes Ingress NGINX Controller Arbitrary Code Execution

Ingress NGINX Controller for Kubernetes versions before 1.11.5, and 1.12.x before 1.12.1 suffer from a critical remote code execution vulnerability. Successful exploitation allows an unauthenticated attacker with access to the pod network to achieve remote code execution RCE in the controller's...

Improper Verification Of Cryptographic Signature

Kyverno is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to improper verification of artifact signatures due to the subjectRegExp and IssuerRegExp fields being ignored in keyless mode, allowing attackers to deploy unauthorized Kubernetes resources,...

CVE-2025-3085

A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to...

[SECURITY] Fedora 40 Update: corosync-3.1.9-2.fc40

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

[SECURITY] Fedora 41 Update: corosync-3.1.9-2.fc41

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...

GHSA-5XF3-GMX4-529V Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...

Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...

CVE-2025-2842

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...

CVE-2025-2842

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions when using the Jaeger UI Monitor tab on OpenShift. A user with create permissions on TempoStack and get permissions on a namespaced Secret can read the token of the Tempo service account and subsequently...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions when using the Jaeger UI Monitor tab on OpenShift. A user with create permissions on TempoStack and get permissions on a namespaced Secret can read the token of the Tempo service account and subsequently...