GHSA-G35J-M5XG-VH3Q vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, k3s...

CVE-2026-57497 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, k3s...

CVE-2026-57497 vulnerabilities

Vulnerabilities for packages: k3s...

GHSA-G35J-M5XG-VH3Q vulnerabilities

Vulnerabilities for packages: k3s...

GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

EUVD-2026-39512

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression...

GHSA-JXR7-MQHW-9P98 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

GHSA-MQR9-HJR8-2M9W vulnerabilities

Vulnerabilities for packages: k3s...

CVE-2023-26248 vulnerabilities

Vulnerabilities for packages: k3s...

CVE-2023-26248 vulnerabilities

Vulnerabilities for packages: rke2-runtime, rke2-runtime-fips, k3s...

GHSA-MQR9-HJR8-2M9W vulnerabilities

Vulnerabilities for packages: rke2-runtime, rke2-runtime-fips, k3s...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, gatekeeper, argocd-image-updater-fips, chisel, argo-workflows, helm, rancher-agent, kubescape, osv-scanner, fscrypt, istio, k9s-fips, kaf, k3s, trivy-fips, gitea-fips, coder-fips, etcd, opentofu-fips, loki, gitlab-workhorse-ce-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-source-controller, fscrypt, kubescape, opentelemetry-collector, loki, prometheus, gitea, chisel, spire-server, containerd, external-dns, k3s, aactl, argocd-image-updater, kaf, rancher, flux, cloud-provider-aws, flux-image-automation-controller, trivy-operator,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: act, flux-source-controller, kubescape, opentelemetry-collector, teleport, ko, argo-events, go-discover, kaf, crossplane-provider-azure-sql, trivy-operator, mods, osv-scanner, opentofu, telegraf, kots, snyk-cli, tflint, docker, nfpm, guac, minio, buildah, helm, podma...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: flux-source-controller, fscrypt, kubescape, opentelemetry-collector, loki, prometheus, gitea, chisel, spire-server, containerd, external-dns, k3s, aactl, argocd-image-updater, kaf, rancher, flux, cloud-provider-aws, flux-image-automation-controller, trivy-operator,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: syft, act, flux-source-controller, fscrypt, kubescape, opentelemetry-collector, loki, argo-events, gitea, prometheus, pulumi, argo-cd, chezmoi, gomplate, spire-server, containerd, external-dns, aactl, k3s, argocd-image-updater, kaf, pulumi-language-dotnet,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: fscrypt, opentelemetry-collector, loki, prometheus, spire-server, containerd, external-dns, k3s, kaf, aactl, rancher, flux, cloud-provider-aws, nerdctl, zot, telegraf, mattermost, kine, kots, gitlab-kas, kubernetes-dashboard, docker-cli-buildx, snyk-cli, cilium,...

CVE-2026-54250

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...

CVE-2026-54250 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...

CVE-2026-54250

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...