PT-2026-41898

Name of the Vulnerable Software and Affected Versions Apache Camel affected versions not specified Description An unauthenticated attacker can perform message header injection due to missing inbound filtering in the CxfRsHeaderFilterStrategy and Knative HeaderFilterStrategy implementations. This...

Apache Camel 安全漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern EIP, developed by the Apache Foundation in the United States. This framework provides implementations of Java objects following the EIP pattern and allows routing and mediation rules to be configured...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: kubevirt-cdi-uploadserver, k8ssandra-client, timoni, kubevirt-cdi-controller-fips, rook-fips, crossplane-provider-aws-cloudsearch-fips, velero-plugin-for-gcp-fips, grafana-pyroscope, terraform-provider-kubernetes-fips, crossplane-provider-azure-operationsmanagement,...

GHSA-CM33-6792-R9FM vulnerabilities

Vulnerabilities for packages: s3proxy-fips, flyway-fips, management-api-for-apache-cassandra-4.1, spark-kubernetes-operator-fips, commercial-elasticsearch, kayenta-fips, apache-hop-fips, opensearch-fips, apache-hop, apache-nifi, opensearch, strimzi-kafka-operator-fips, apache-pulsar-fips, seata,...

CVE-2026-42579 vulnerabilities

Vulnerabilities for packages: s3proxy-fips, flyway-fips, management-api-for-apache-cassandra-4.1, spark-kubernetes-operator-fips, commercial-elasticsearch, kayenta-fips, apache-hop-fips, opensearch-fips, apache-hop, apache-nifi, opensearch, strimzi-kafka-operator-fips, apache-pulsar-fips, seata,...

GHSA-5QCV-4RPC-JP93 vulnerabilities

Vulnerabilities for packages: debezium-connector-vitess, debezium, opensearch-fips, apache-nifi, strimzi-kafka-operator-fips, opensearch, seata, debezium-connector-db2, druid, hono, debezium-connector-informix, knative-kafka-broker, knative-kafka-broker-fips, strimzi-kafka-operator, thingsboard,...

CVE-2026-35554 vulnerabilities

Vulnerabilities for packages: debezium-connector-vitess, debezium, opensearch-fips, apache-nifi, strimzi-kafka-operator-fips, opensearch, seata, debezium-connector-db2, druid, hono, debezium-connector-informix, knative-kafka-broker, knative-kafka-broker-fips, strimzi-kafka-operator, thingsboard,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: policy-controller, aws-efs-csi-driver, docker-cli-buildx, terraform-provider-random, newrelic-infrastructure-agent, ko, step-kms-plugin, kubernetes-event-exporter, crossplane-provider-azure-storage, flannel, kubescape-operator, kyverno-notation-aws, kube-arangodb,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: policy-controller, aws-efs-csi-driver, docker-cli-buildx, terraform-provider-random, newrelic-infrastructure-agent, ko, step-kms-plugin, kubernetes-event-exporter, crossplane-provider-azure-storage, flannel, kubescape-operator, kyverno-notation-aws, kube-arangodb,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, k8ssandra-client, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, db-operator, opentelemetry-operator, timoni, keda-fips, falcoct...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, k8ssandra-client, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, db-operator, opentelemetry-operator, timoni, keda-fips, falcoct...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, chezmoi, k8ssandra-client, nri-postgresql, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, db-operator, longhorn-cli-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager-fips, external-secrets-operator, kubevirt-cdi-uploadserver, gomplate-fips, chezmoi, k8ssandra-client, nri-postgresql, argo-rollouts, azuredisk-csi, crossplane-provider-aws-lambda-fips, db-operator, longhorn-cli-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: kubevirt-cdi-uploadserver, k8ssandra-client, nri-postgresql, minify, timoni, kubevirt-cdi-controller-fips, yunikorn-web, protoc-gen-go, otel-cli, grafana-pyroscope, terraform-provider-kubernetes-fips, kubernetes-ingress-defaultbackend-fips, crossplane-provider-aws-ec...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gomplate-fips, kubo-fips, keda-fips, temporal-server, falcoctl, cg, rook-fips, argo-workflows, amazon-ssm-agent, velero-plugin-for-gcp-fips, cluster-api-aws-controller-fips, kube-arangodb, seaweedfs-rocksdb, frankenphp-8.5, grafana-pyroscop...

GO-2026-4880 Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik...

PT-2026-29932

Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass in github.com/traefik/traefik...

SUSE CVE-2026-32695

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative rules.hosts was...

CVE-2026-32695

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When using the Knative provider, Traefik incorrectly interpolates user-controlled values into router rule expressions without proper escaping. This vulnerability allows an attacker to inject malicious rule syntax, leading to a...

GHSA-67JX-R9PV-98RJ Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass

Summary There is a potential vulnerability in Traefik's Kubernetes Knative, Ingress, and Ingress-NGINX providers related to rule injection. User-controlled values are interpolated into backtick-delimited Traefik router rule expressions without escaping or validation. A malicious value containing ...