CLEANSTART-2026-HP02816 Security fixes in eks-distro-kube-controller-manager-fips 1.34.2-r0

Package eks-distro-kube-controller-manager-fips version 1.34.2-r0 fixes 21 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-CF63541 Security fixes in eks-distro-coredns-fips 1.35.7-r0

Package eks-distro-coredns-fips version 1.35.7-r0 fixes 6 vulnerabilities: ghsa-cfpf-hrx2-8rv6, ghsa-p77j-4mvh-x3m3, ghsa-9h8m-3fm2-qjrq, CVE-2025-68156, CVE-2026-24051...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: helm-exporter, gpu-operator, crossplane-provider-aws-batch, trivy-k8s-wrapper-fips, crossplane-provider-azure-streamanalytics, cluster-proportional-autoscaler-fips, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, fairwinds-gemini, upwind-agen...

CVE-2026-42505 vulnerabilities

Vulnerabilities for packages: helm-exporter, gpu-operator, crossplane-provider-aws-batch, trivy-k8s-wrapper-fips, crossplane-provider-azure-streamanalytics, cluster-proportional-autoscaler-fips, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, fairwinds-gemini, upwind-agen...

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, azuredisk-csi, argo-cd-fips, harvester, longhorn-manager, rke2-runtime-fips, longhorn-share-manager-fips, kubernetes-csi-driver-hostpath, longhorn-manager-fips, longhorn-share-manager, azurefile-csi, azurefile-csi-fips, harvester-fips, eks-distr...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: rancher-system-agent, azuredisk-csi, argo-cd-fips, harvester, longhorn-manager, rke2-runtime-fips, longhorn-share-manager-fips, kubernetes-csi-driver-hostpath, longhorn-manager-fips, longhorn-share-manager, azurefile-csi, azurefile-csi-fips, harvester-fips, eks-distr...

CVE-2026-33726 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is...

CVE-2026-33726

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, flux-source-controller, helm-exporter, cluster-api-gcp-controller, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, terraform-provider-time-fips, beats, terraform-provider-azurerm-fips,...

CVE-2025-47913 vulnerabilities

Vulnerabilities for packages: vault, cert-manager-fips, rke2-runtime-fips, gitlab-rails-ce-fips, terraform, gitlab-rails-ce, k3s, kube-conformance, falco-no-driver, consul-k8s, etcd-fips, etcd, backup-restore-operator...

GHSA-56W8-48FP-6MGV vulnerabilities

Vulnerabilities for packages: vault, cert-manager-fips, rke2-runtime-fips, gitlab-rails-ce-fips, terraform, gitlab-rails-ce, k3s, kube-conformance, falco-no-driver, consul-k8s, etcd-fips, etcd, backup-restore-operator...

CVE-2025-14503

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-14503: Incorrect Privilege Assignment

An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumption. The sample code for the EKS environment provisioning role is configured to trust the account root principal, which may enable any IAM...

CVE-2025-64709

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...

CVE-2025-31133 vulnerabilities

Vulnerabilities for packages: grafana-alloy, podman, virt-handler, prometheus-podman-exporter, cluster-autoscaler, falco-no-driver, azure-container-networking, kubernetes, rancher, rke2-runtime, ctop-fips, sriov-network-device-plugin, virt-handler-fips, eks-distro, grafana-alloy-fips,...

GHSA-CGRX-MC8F-2PRM vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, trivy-operator, grafana-alloy, xeol-fips, cluster-autoscaler, skopeo, nerdctl-fips, blob-csi-fips, skaffold-fips, syft, ctop-fips, mesosphere-vsphere-csi, eks-distro, k8s-device-plugin-fips, k9s, nvidia-container-toolkit, envoy-gateway, syft-fips,...

GHSA-9493-H29P-RFM2 vulnerabilities

Vulnerabilities for packages: grafana-alloy, podman, virt-handler, prometheus-podman-exporter, cluster-autoscaler, falco-no-driver, azure-container-networking, kubernetes, rancher, rke2-runtime, ctop-fips, sriov-network-device-plugin, virt-handler-fips, eks-distro, grafana-alloy-fips,...

GHSA-QW9X-CQR3-WC7R vulnerabilities

Vulnerabilities for packages: grafana-alloy, podman, prometheus-podman-exporter, cluster-autoscaler, falco-no-driver, azure-container-networking, kubernetes, rancher, rke2-runtime, ctop-fips, sriov-network-device-plugin, eks-distro, grafana-alloy-fips, nvidia-container-toolkit,...

CVE-2025-52565 vulnerabilities

Vulnerabilities for packages: grafana-alloy, podman, prometheus-podman-exporter, cluster-autoscaler, falco-no-driver, azure-container-networking, kubernetes, rancher, rke2-runtime, ctop-fips, sriov-network-device-plugin, eks-distro, grafana-alloy-fips, nvidia-container-toolkit,...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, trivy-operator, grafana-alloy, xeol-fips, cluster-autoscaler, skopeo, nerdctl-fips, blob-csi-fips, skaffold-fips, syft, ctop-fips, mesosphere-vsphere-csi, eks-distro, k8s-device-plugin-fips, k9s, nvidia-container-toolkit, envoy-gateway, syft-fips,...