GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: manifest-tool, crossplane-provider-aws-kinesis, cyberark-secrets-provider-for-k8s, crossplane-provider-aws-sns-fips, kubescape, kube-mgmt, fulcio-fips, falcosidekick-fips, helmfile, octo-sts, opentelemetry-ebpf-instrumentation-fips,...

GHSA-CP6G-7HQX-QXHP vulnerabilities

Vulnerabilities for packages: cortex, juicefs, ferretdb, dapr, splunk-otel-collector, kubescape-operator, opentelemetry-collector-contrib, teleport, grafana-pyroscope, promxy, terraform-provider-pagerduty, bento, weaviate, ratify, cilium, thanos, tekton-chains, kubescape, consul-k8s, tetragon,...

CVE-2026-2303 vulnerabilities

Vulnerabilities for packages: cortex, juicefs, ferretdb, dapr, splunk-otel-collector, kubescape-operator, opentelemetry-collector-contrib, teleport, grafana-pyroscope, promxy, terraform-provider-pagerduty, bento, weaviate, ratify, cilium, thanos, tekton-chains, kubescape, consul-k8s, tetragon,...

CVE-2026-5061

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...

SUSE CVE-2025-11374

Consul and Consul Enterprise's "Consul" key/value endpoint is vulnerable to denial of service DoS due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12...

SUSE CVE-2025-11375

Consul and Consul Enterprise's “Consul” event endpoint is vulnerable to denial of service DoS due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12...

CVE-2026-27172

A flaw was found in the camel-consul component of Apache Camel. An attacker with write access to the Consul Key-Value KV store could inject a malicious serialized Java object. When Apache Camel's ConsulRegistry deserializes this object, it can lead to arbitrary code execution within the Camel...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: tw, gogatekeeper, docker-cli-buildx, helm-operator, containerd, helm-push, k3s, envoy-gateway, gatekeeper, fuse-overlayfs-snapshotter, kubescape-operator, opa-envoy, ctop, kaniko, manifest-tool, teleport, steampipe, k9s, trivy, spegel, kube-arangodb, dagger, k8sgpt,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: tw, gogatekeeper, docker-cli-buildx, helm-operator, containerd, helm-push, k3s, envoy-gateway, gatekeeper, fuse-overlayfs-snapshotter, kubescape-operator, opa-envoy, ctop, kaniko, manifest-tool, teleport, steampipe, k9s, trivy, spegel, kube-arangodb, dagger, k8sgpt,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: manifest-tool, kube-mgmt-fips, kubescape, cloudbeat, kube-mgmt, packer, trivy-operator, helm-mapkubeapis, buildkitd-fips, kaniko, linkerd2, helm-set-status, datadog-agent-fips, docker-cli-buildx, chaos-mesh-fips, syft-fips, helm-push, kots, redpanda-operator,...

SUSE SLES15 Security Update : zypper-docker (SUSE-SU-2026:1951-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1951-1 advisory. This update for zypper-docker fixes the following issues - CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied fi...

CLEANSTART-2026-GP85500 Security fixes for ghsa-mh2q-q3fh-2475 applied in versions: 1.22.7-r0

Security vulnerability affects the consul-fips package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-44430

Security vulnerability affects the consul-fips package. This issue is resolved in later releases. See references for vulnerability details...

BIT-CONSUL-2026-5061 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...

Symlink Attack

Overview github.com/hashicorp/consul-template/template is a template rendering, notifier, and supervisor for @hashicorp Consul and Vault data Affected versions of this package are vulnerable to Symlink Attack via the file helper when a symbolic link is used to bypass the intended sandbox...

EUVD-2026-29483

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...

CVE-2026-5061

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...

Security Bulletin: Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack

Summary The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0. Vulnerability Details CVEID:CVE-2026-5061 DESCRIPTION:...

CVE-2026-5061

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...

CVE-2026-5061 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability CVE-2026-5061 is fixed in consul-template 0.42.0...