266 matches found
Insecure Default Initialization of Resource
Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the misconfiguration of the ReadOnlyPort setting. An attacker can gain unauthorized access to exposed credentials by connecting to the open port without authentication. Remediation...
CVE-2025-46599
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...
k3s 安全漏洞
k3s is a lightweight Kubernetes open source from k3s. A security vulnerability exists in k3s versions prior to 1.32 to 1.32.4-rc1+k3s1 that stems from a kubelet configuration change that could lead to unauthenticated access to the ReadOnlyPort port...
CVE-2025-46599
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...
PT-2025-17879
Name of the Vulnerable Software and Affected Versions CNCF K3s versions 1.32.0-rc1 through 1.32.4-rc1+k3s1 Description A change in the Kubernetes kubelet configuration within the 1.32 branch transitioned from legacy CLI flags to the v1beta1.KubeletConfiguration structure. Due to the use of...
CVE-2025-46599
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...
CVE-2025-46599
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...
CVE-2025-46599
CVE-2025-46599 affects CNCF K3s 1.32 before 1.32.4-rc1+k3s1. The issue is a kubelet configuration change that, in some scenarios, leaves ReadOnlyPort at 10255, potentially allowing unauthenticated access and exposure of credentials. The CVE’s public details indicate the impact is credentials expo...
CVE-2025-30204 vulnerabilities
Vulnerabilities for packages: policy-controller, cortex, kubernetes-dashboard-auth, kargo, spire-server, terraform-provider-azapi, terraform, weaviate, kine, crossplane-provider-azure-sql, flux-kustomize-controller, argocd-image-updater, crossplane-provider-azure-managedidentity,...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: dive, gcsfuse, cortex, flannel-cni-plugin, kaf, logstash-exporter, kube-state-metrics, tailscale, aws-flb-firehose, memcached-exporter, temporal, helm-push, terraform, smarter-device-manager, kine, nri-mysql, newrelic-fluent-bit-output, flux-helm-controller, nri-mssq...
CVE-2023-0475 affecting package k3s 1.24.12-2
CVE-2023-0475 affecting package k3s 1.24.12-2. This CVE either no longer is or was never applicable...
CVE-2022-3294 affecting package k3s 1.24.12-2
CVE-2022-3294 affecting package k3s 1.24.12-2. This CVE either no longer is or was never applicable...
CVE-2023-25173 affecting package k3s 1.24.12-2
CVE-2023-25173 affecting package k3s 1.24.12-2. This CVE either no longer is or was never applicable...
GHSA-PX8V-PP82-RCVR vulnerabilities
Vulnerabilities for packages: q, traefik-fips, frp, kubernetes-dns-node-cache, k3s, traefik, kubernetes-dns-node-cache-fips, eks-distro, spegel, buf, cloudflared, caddy-fips, eks-distro-fips, caddy...
CVE-2024-53259 vulnerabilities
Vulnerabilities for packages: q, traefik-fips, frp, kubernetes-dns-node-cache, k3s, traefik, kubernetes-dns-node-cache-fips, eks-distro, spegel, buf, cloudflared, caddy-fips, eks-distro-fips, caddy...
OPENSUSE-SU-2024:10884-1 k3s-1.21.3+k3s1-1.2 on GA media
These are all security issues fixed in the k3s-1.21.3+k3s1-1.2 package on the GA media of openSUSE Tumbleweed...
CVE-2024-22189 vulnerabilities
Vulnerabilities for packages: caddy, cloudflared, k3s, q...
GHSA-C33X-XQRF-C478 vulnerabilities
Vulnerabilities for packages: caddy, cloudflared, k3s, q...
CVE-2024-27304 vulnerabilities
Vulnerabilities for packages: kube-bench-fips, trillian-fips, kine, argo-workflows, ferretdb, caddy, argo-workflows-fips, step-ca, kots, trillian, step, caddy-fips, wavefront-collector-for-kubernetes, temporal-server-fips, src, spicedb, falcosidekick-fips, k3s, temporal-server, amass, kube-bench...