50 matches found
CVE-2026-75036
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...
CVE-2026-75036
Fleet (Rancher's GitOps operator) is vulnerable to DNS-based information disclosure during Helm template preprocessing. The Sprig getHostByName function, evaluated by the Fleet controller, can reach network resources outside the management cluster, allowing a user who can supply bundle content to...
cve-2024-10220-test
CVE-2024-10220 测试仓库 此仓库用于测试 CVE-2024-10220（Kubernetes gitRepo volume 漏洞），作为中俄克拉荷马大学 HPC 安全研究的一部分。 警告： 此仓库包含用于受控安全测试的恶意 Git 钩子。请勿在生产环境中使用。 漏洞详情 CVE: CVE-2024-10220 组件： Kubernetes kubelet gitRepo volumes 影响： Kubernetes 节点上的任意命令执行 严重性： 高 CVSS 8.1 研究目的 此仓库是对 HPC 作业调度器（Slurm, HTCondor,...
CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability
CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability Mark Mallia 작성 컨테이너화와 자동화의 힘 컨테이너화는 현대 애플리케이션 제공의 중추입니다. 전체 런타임 스택을 단일의 불변 이미지로 묶어 클러스터의 모든 호스트에 예기치 않은 문제 없이 배포할 수 있습니다. Kubernetes는 이러한 이미지를 가져와 파드로 스케줄링하며, 선언적 모델로 네트워킹부터 스토리지까지 모든 것을 조율합니다. 이는 고도로 분산된 환경과 여러 앱이 서비스되는 환경에서 유용합니다. 이 스택이 대규모...
CVE-2026-44948 Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...
Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017390)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017390 advisory. The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
EUVD-2026-23963
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths...
GHSA-X3J7-7PGJ-H87R Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604 Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
CVE-2026-32604 affects Spinnaker before the patched releases 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2. The vulnerability arises in clouddriver components when handling gitrepo artifacts, allowing a bad actor to execute arbitrary commands on the pod (RCE) by exploiting improper input handling on...
CVE-2026-32604 Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
PT-2026-33842
Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.0 Spinnaker versions prior to 2026.0.1 Spinnaker versions prior to 2025.4.2 Spinnaker versions prior to 2025.3.2 Description An issue in the clouddriver pods allows an attacker to execute arbitrary commands...
EUVD-2025-6386
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2025-1767
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the...
GHSA-XGPC-Q899-67P8 Fleet doesn’t validate a server’s certificate when connecting through SSH
Impact A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet...