13 matches found
CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450
The CVE-2026-14450 issue affects the MaaS API, where any pod in the cluster can bypass the Kuadrant AuthPolicy gateway by forging HTTP headers (X-MaaS-Username and X-MaaS-Group) that are trusted verbatim. Root cause: lack of first‑party authentication between components allowing header-based auth...
CVE-2026-14450
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
CVE-2026-14450: Authentication Bypass by Spoofing
A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, specifically X-MaaS-Username and X-MaaS-Group, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain...
EUVD-2025-7228
Malicious code in bioql PyPI...
GO-2025-3746 Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino
Authorino Uncontrolled Resource Consumption vulnerability in github.com/kuadrant/authorino...
CVE-2024-53349
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...
CVE-2024-53349
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...
CVE-2024-53349
Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...
CVE-2024-53349
Insecure permissions in kuadrant v0.11.3 (also identified as kubeslice in some records) allow an attacker to gain access to a service account's token . This flaw leads to an escalation of privileges via the secretes component within a k8s cluster . A proof-of-concept was published on March 24, 20...