GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: stakater-reloader, actions-runner-controller, github-mcp-server, smarter-device-manager, flux-image-reflector-controller, nova, omnibump, goreleaser, clickhouse-operator, grafana-operator, sftpgo-plugin-eventsearch, fluxcd-kustomize-mutating-webhook, supercronic,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, aws-node-termination-handler, kine, tofu-controller, k8ssandra-operator, libnvidia-container, hubble-ui, sftpgo-plugin-pubsub, terraform-provider-tls, goreleaser, scorecard, spqr, terraform, secrets-store-csi-driver, rancher-agent, dex,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: thanos-operator, cloud-provider-azure, kustomize, amass, goreleaser, newrelic-nri-statsd, mockery, rancher-agent, dex, percona-server-mongodb-operator, rook, spicedb-operator, argo-cd, hubble, aws-signer-notation-plugin, rancher-webhook, cert-exporter,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: thanos-operator, cloud-provider-azure, kustomize, amass, goreleaser, newrelic-nri-statsd, mockery, rancher-agent, dex, percona-server-mongodb-operator, rook, spicedb-operator, argo-cd, hubble, aws-signer-notation-plugin, rancher-webhook, cert-exporter,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: thanos-operator, cloud-provider-azure, kustomize, amass, goreleaser, newrelic-nri-statsd, mockery, rancher-agent, dex, percona-server-mongodb-operator, rook, spicedb-operator, argo-cd, hubble, aws-signer-notation-plugin, rancher-webhook, cert-exporter,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm-set-status, consul-k8s, k9s-fips, k9s, chartmuseum, helm-exporter, tigera-operator-fips, kubescape-server, helm-diff, helm, kubescape, pluto, tw, k8ssandra-client, k8sgpt, zot, linkerd2, zarf, flux-fips, cerbos-fips, flux-source-controller-fips, jfrog-cli,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, nri-kafka-fips, terraform-provider-time, kyverno-policy-reporter-ui-fips, grafana-rollout-operator, victorialogs, amazon-cloudwatch-agent-operator-fips, weaviate, google-guest-agent, spiffe-helper-fips, litestream, mc, temporal-ui-server-fips...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, weaviate, spiffe-helper-fips, k8ssandra-client, harbor-scanner-trivy-fips, flux-operator-fips, azurefile-csi-fips, aws-signer-notation-plugin, atlantis, direnv, prometheus-pgbouncer-exporter-fips, prometheus-adapter, sftpgo-plugin-pubsub,...

PT-2026-32126

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

GHSA-W5FQ-8965-C969 Juju: CloudSpec method leaking cloud credentials

Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...

Juju: CloudSpec method leaking cloud credentials

Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...

EUVD-2026-21364

Juju: CloudSpec method leaking cloud credentials...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the CloudSpec method on the Controller facade. An attacker can obtain sensitive cloud credentials by making an authenticated API call with only basic login permissions, without requiring elevated privileges...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-5412

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...

CVE-2026-5412

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...

CVE-2026-5412

CVE-2026-5412 (Juju) : An authorization issue in the Juju Controller facade allows an authenticated, low-privileged user to call the CloudSpec API and extract cloud credentials used to bootstrap the controller. This affects Juju versions prior to 2.9.57 and 3.6.21. The issue is mitigated by upgra...

CVE-2026-5412 Juju CloudSpec API could leak senstive information

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...