CVE-2026-53576

Kestra (OSS) before versions 1.0.45 and 1.3.21 is affected by an authentication bypass in the REST API filter. The code checks request.getPath().endsWith("/configs") instead of matching the exact endpoint, causing anonymous bypass to endpoints like /api/v1/{tenant}/flows/configs and /api/v1/{tena...

CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

EUVD-2026-39919

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, falcoctl-fips, kyverno-fips, slsa-verifier, neuvector-sigstore-interface, kubescape-server-fips, tbot, tekton-chains-fips, policy-controller, gitsign, kyverno, crossplane, cloudbeat, aactl, goreleaser, crossplane-fips, ko,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, falcoctl-fips, kyverno-fips, slsa-verifier, neuvector-sigstore-interface, kubescape-server-fips, tbot, tekton-chains-fips, policy-controller, gitsign, kyverno, crossplane, cloudbeat, aactl, goreleaser, crossplane-fips, ko,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: zot, kuma, knative-serving-fips, upwind-agent, frankenphp-8.3, frankenphp-8.4, omnictl-multiarch-fips, k9s, tekton-pipelines-fips, prometheus-operator, aactl, cilium-cli, kube-arangodb-fips, zarf-fips, istio, tekton-pipelines, argo-workflows, chisel, kubernetes-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sesv2, crossplane-provider-aws-osis, falcoctl-fips, crossplane-provider-aws-efs-fips, gomplate, kyverno-notation-aws-fips, crossplane-provider-aws-chime, nfpm, crossplane-provider-aws-elasticache, tekton-chains-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sesv2, crossplane-provider-aws-osis, falcoctl-fips, crossplane-provider-aws-efs-fips, gomplate, kyverno-notation-aws-fips, crossplane-provider-aws-chime, nfpm, crossplane-provider-aws-elasticache, tekton-chains-fips,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, gomplate, zot, kuma, nfpm, knative-serving-fips, upwind-agent, argo-events-fips, guac, frankenphp-8.3, frankenphp-8.4, omnictl-multiarch-fips, k9s, longhorn-manager, teleport-operator-fips, tekton-pipelines-fips, prometheus-operator, aactl,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: zot, kuma, knative-serving-fips, upwind-agent, frankenphp-8.3, frankenphp-8.4, omnictl-multiarch-fips, teleport-operator-fips, tekton-pipelines-fips, prometheus-operator, aactl, cilium-cli, kube-arangodb-fips, docker-cli-buildx-fips, packer, istio, tekton-pipelines,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, opentelemetry-collector, glab, tkn, nfpm, neuvector-sigstore-interface, gptscript, wolfictl, rootlesskit, apko, pulumi-kubernetes-operator, flux-image-automation-controller, ksops, melange, ko, chisel, k3s, policy-controller, loki,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, opentelemetry-collector, glab, tkn, nfpm, neuvector-sigstore-interface, gptscript, wolfictl, rootlesskit, apko, pulumi-kubernetes-operator, flux-image-automation-controller, ksops, melange, ko, chisel, k3s, policy-controller, loki,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: minio, opentelemetry-collector, snyk-cli, kubernetes, kots, docker-cli-buildx, istio, flux, cilium-cli, telegraf, external-dns, spire-server, helm, aactl, containerd, kaf, zot, gitlab-kas, buildah, k3s, kubernetes-dashboard, prometheus-operator, loki, kyverno,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, nfpm, gptscript, wolfictl, rootlesskit, apko, pulumi-kubernetes-operator, flux-image-automation-controller, melange, chisel, k3s, loki, rancher-agent, podman, gatus, docker, rancher, cloud-provider-aws, kine, rancher-machine, gitea, zarf,...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...