CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-18608

The vulnerability CVE-2026-18608 affects the Data Science Pipelines Operator (DSPO). Its ClusterRole grants excessive privileges beyond what is needed, including pods/exec and cluster-wide role/binding control. If a DSPO pod is compromised, an attacker could leverage these permissions to achieve ...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges due to excessive permissions granted to the ClusterRole associated with the controller, which allows full access to Secrets. An attacker can access, modify, or delete sensitive information by...

PT-2024-29587 · Kubean · Kubean

Name of the Vulnerable Software and Affected Versions: Kubean versions prior to 0.18.0 Description: The issue concerns a cluster lifecycle management toolchain where the ClusterRole has excessive permissions, allowing a malicious user to abuse these permissions and perform any action on the whole...