160 matches found
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...
EUVD-2026-26432
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...
CVE-2026-41174 Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects...
Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding
Summary There is a vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the createChainMiddleware function. Even when providers.kubernetesCRD.allowCrossNamespace=false is set, references in spec.chain.middlewares may be followed to access objects in other namespaces. A user with...
EUVD-2026-20965
Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection through the column.go processing in the PostgreSQL and MySQL table schema components. An attacker can tamper with the database table structure and potentially leak data by creating a malicious Table CRD with crafted column...
Important: Red Hat Security Advisory: Cluster Observability Operator 1.4.0
The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.4 release of COO...
SUSE CVE-2026-26056
Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. It allows users with CR create/update permissions to execute arbitrary WASM code in the ATC controller context by injecting a...
Rucio 安全漏洞
Rucio is an open-source scientific data management tool developed by Rucio team. Versions of Rucio prior to 35.8.3, 38.5.4, and 39.3.1 contained security vulnerabilities. These vulnerabilities stemmed from uncontrolled input in the Custom RSE Attribute of the WebUI, which allowed attackers to...
Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.2 security update
Important: Red Hat OpenShift GitOps v1.18.2 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-7608 Redis HA pods are taking longer than expected to come up GITOPS-7789 Version override in ArgoCD CR causes operator to use upstream images...
GO-2025-4125 Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator...
Important: Red Hat Security Advisory: Cluster Observability Operator 1.3.0
The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.3 release of COO...
EUVD-2025-25456
Keycloak Potential Variable Reference in Model Storage Services...
Keycloak Potential Variable Reference in Model Storage Services
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
PT-2025-40721
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak exists in the mvebu driver when the driver detaches. This leak was identified by Uwe Kleine-König and is addressed with a custom devm action. Recommendations At the momen...
EUVD-2023-0823
Malicious code in bioql PyPI...