litmus

LitmusChaos 오픈 소스 카오스 엔지니어링 플랫폼 다른 언어는여기를 참조하세요. 🇰🇷 🇨🇳 🇧🇷 🇮🇳 개요 LitmusChaos는 통제된 방식으로 카오스 테스트를 실행하여 팀이 인프라의 약점과 잠재적인 운영 중단을 파악할 수 있게 해주는 오픈 소스 카오스 엔지니어링 플랫폼입니다. 개발자와 SRE는 LitmusChaos를 통해 카오스 엔지니어링을 도입할 수 있으며, 이는 사용하기 쉽고 현대 카오스 엔지니어링 원칙에 기반하며 커뮤니티의 협력으로 운영됩니다. LitmusChaos는 100% 오픈 소스이며 CNCF 프로젝트입니다...

EUVD-2026-78880

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

EUVD-2026-75290

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

PT-2026-79122

Name of the Vulnerable Software and Affected Versions multicloud-operators-subscription affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources CRs to bypass security controls. Th...

CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

EUVD-2026-60958

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834: Cleartext Storage of Sensitive Information

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

PT-2026-77155

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the must-gather component allows certain ACM wrapper Custom Resources that embed Secret data to be collected without redaction. When an...

PT-2026-71287

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the multicloud-operators-subscription component allows a namespace-admin tenant to execute a confused-deputy attack. By creating Subscription Custom...

CVE-2026-16456

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

CVE-2026-17617

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-17617

IBM Application Gateway Operator (versions 22.2–26.06) is affected by a Server-Side Request Forgery (SSRF) due to insufficient validation of URLs in custom resources. The issue is documented across multiple sources (NVD entry and IBM security bulletin), with the IBM bulletin listing CVSS v3.1 bas...

CVE-2026-17617: Server-Side Request Forgery (SSRF)

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

CVE-2026-55723

When NGINX Ingress Controller is configured with Custom Resource Definitions CRDs or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without...

Fission 安全漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.24.0 contain security vulnerabilities. These vulnerabilities arise from the buildermgr controller failing to verify that Package.spec.environment.namespace matches Package.metadata.namespac...

CVE-2026-10840

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the...

Traefik 安全漏洞

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Vulnerabilities exist in versions prior to Traefik 2.11.43, 3.6.14, and 3.7.0-rc.2. These vulnerabilities stem from incomplete isolation of Kubernetes CRD-provided programs across namespaces, and lack restrictio...