kratos

채팅 · 토론 · 뉴스레터 · 문서 · Ory Network 사용해보기 · 채용 Ory Kratos는 클라우드 네이티브 애플리케이션을 위한 API 우선 아이덴티티 및 사용자 관리 시스템입니다. 로그인, 회원가입, 계정 복구, 인증, 프로필 관리 흐름을 중앙화하여 서비스가 이를 직접 다시 구현하지 않고 사용할 수 있게 합니다. 목차 Ory Kratos란 무엇인가? Ory Kratos를 선택해야 하는 이유 Auth0, Okta 및 유사 제공업체에서 마이그레이션하기 배포 옵션 Ory Network에서 Ory Kratos 사용하기 O...

kratosminifilter

🛡️ Kratos Minifilter — Windows 커널 안티-랜섬웨어 드라이버 방어적 보안 연구 프로젝트 — C++로 개발된 Windows 미니필터 드라이버로, 커널 수준Ring 0에서 랜섬웨어를 실시간 탐지 및 무력화합니다. 📋 목차 개요 아키텍처 탐지 메커니즘 디지털 지문 기반 블랙리스트 설치 설정 한계 법적 경고 개요 Kratos Kratos.sys는 필터 관리자fltmgr.sys를 통해 고도 425342안티바이러스 계층에서 작동하는 Windows 미니필터 드라이버입니다. 정적 시그니처 기반 안티바이러스 솔루션과 달리...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: conftest-fips, harbor-scanner-trivy, minc, zarf-fips, restic, k8s-metacollector-fips, kbld-fips, grpcurl, tbot, flux-source-watcher-fips, helm-operator-fips, flux-image-automation-controller-fips, cilium-cli, crossplane-provider-aws-cloudcontrol-fips, consul-k8s,...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: atlantis-fips, argo-events, kubernetes-event-exporter-fips, kyverno-policy-reporter, atlantis, bento-fips, bento, argo-cd, peerdb-flow, kubewatch, argo-events-fips, argo-cd-fips, kyverno-policy-reporter-fips, argo-rollouts, argo-rollouts-fips, goreleaser,...

SUSE CVE-2026-6993

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

SUSE CVE-2026-42300

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

GO-2026-5471 Kratos has a Confused Deputy issue in github.com/go-kratos/kratos

Kratos has a Confused Deputy issue in github.com/go-kratos/kratos...

GHSA-GXHX-2686-5H9G vulnerabilities

Vulnerabilities for packages: atlantis-fips, argo-events, kubernetes-event-exporter-fips, kyverno-policy-reporter, atlantis, bento-fips, bento, argo-cd, peerdb-flow, kubewatch, argo-events-fips, argo-cd-fips, kyverno-policy-reporter-fips, argo-rollouts, argo-rollouts-fips, goreleaser,...

CVE-2026-42300

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

CVE-2026-42300

CVE-2026-42300 affects DevGuard’s SessionMiddleware and related components prior to version 1.2.2. The vulnerability arises because a client-supplied header, X-Admin-Token , is accepted and its raw value is used as the authenticated userID when no Kratos session cookie is present. An attacker who...

CVE-2026-42300 DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

devguard 安全漏洞

Devguard is a software supply chain vulnerability management platform developed by L3montree. Versions prior to 1.2.2 of Devguard contained security vulnerabilities. These vulnerabilities stemmed from SessionMiddleware accepting the X-Admin-Token HTTP request header provided by clients. When no...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: argo-workflows, chainloop-control-plane-fips, spire-server-fips, gitlab-kas, flyte, caddy-fips, pgtimetable, hydra, envoy-gateway, trillian, temporal, sqlexporter-fips, peerdb-flow, ldap2pg, k3s, jitsucom-bulker, authentik-fips, keda, step-ca-fips,...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the SessionMiddleware process when the X-Admin-Token HTTP header is accepted from the client and its raw value is used as the authenticated user ID if no Kratos session cookie ...

Linux Distros Unpatched Vulnerability : CVE-2026-6993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component...

CVE-2026-6993

A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's NewServer function, specifically within the http.DefaultServeMux Fallback Handler. This manipulation creates an unintended intermediary, which can lead to the disclosure of sensitive...

GHSA-JJ45-XVQ5-RHH9 Kratos has a Confused Deputy issue

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

Kratos has a Confused Deputy issue

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...