CVE-2026-2270 StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

CVE-2026-2270

A confused deputy attack exists in the Kubernetes kube-controller-manager (specifically the StatefulSet controller). It allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a pod in a different namespace. Because the controller restores dat...

EUVD-2026-110501

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespaces...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespace...

CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

EUVD-2026-109182

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115883

The LangGraph checkpoint savers, specifically the PostgresStore , AsyncPostgresStore , SqliteStore , and AsyncSqliteStore components, are vulnerable to a cross-namespace data access issue. The root cause is that these stores flatten namespace labels using ".".join(namespace), but validation only ...

CVE-2026-115883 LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115365

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

CVE-2026-115365

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

EUVD-2026-108290

OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other...

PT-2026-121545

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.0 through 2.6.2 Description An incorrect authorization issue exists in the ACL policy cache. This allows tokens to reference policies from arbitrary namespaces through the use of specially crafted policy names. Consequentl...

CVE-2026-112778

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

EUVD-2026-104584

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

CVE-2026-112778

The Traefik ingress controller (versions before 2.11.46 , 3.x before 3.6.17 , and 3.7.0 ) is vulnerable to a cross-namespace resource reference issue within the Kubernetes Ingress provider . The root cause is a lack of namespace validation for Ingress and Service annotations. This allows an attac...

CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

PT-2026-117629

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.46 Traefik versions prior to 3.6.17 Traefik version 3.7.0 Description The Kubernetes Ingress provider lacks namespace validation for Ingress and Service annotations. This allows references to Middlewares,...