cluster-image-scanner

ClusterImageScanner プロダクション環境における脆弱性とコンテナイメージの設定ミスを検出します。 はじめに ClusterImageScanner は、Kubernetes クラスター内のイメージを検出し、さまざまなセキュリティテストに基づいて迅速なフィードバックを提供します。実際に影響のあるセキュリティ問題に対して最新のフィードバックを得るために、プロダクション環境で ClusterImageScanner を実行することを推奨します。 ClusterImageScanner 自体は Kubernetes...

mesh-kridik

mesh-kridik Kubernetes 서비스 메시 보안을 강화하세요!! mesh-kridik는 Istio 서비스 메시가 있는 Kubernetes 클러스터에서 다양한 보안 검사를 수행하고 보안 보고서를 출력하는 오픈 소스 보안 검사기입니다. 보안 검사 테스트는 istio 보안 모범 사례의 완전한 구현입니다. 보안 검사는 Istio 서비스 메시가 있는 Kubernetes 클러스터에서 수행되며 OPAOpen Policy Agent를 활용하여 보안 규칙을 적용합니다. 출력 감사 보고서에는 보안 문제의 근본 원인과 보안 문제에 대한...

permission-manager

Permission manager Welcome to the Permission Manager! 🎉 🎉 Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBAC management for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this...

kube-alien

Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...

kubetcd

Kubetcd https://github.com/jpbetz/auger のラッパーです。 etcd に直接書き込むことでポッドのデプロイを自動化します。侵害済み etcd のポストエクスプロイテーションのための複数の機能を含みます。 Disclaimer !WARNING これは PoC であり、本番環境では使用しないでください。etcd に直接書き込むと、不整合やデータ破損が発生する可能性があり、kube-apiserver のロジックが etcd からデータを取得または操作できなくなる可能性があります。複数ノードのテスト環境は KIND でデプロイできます。 Why?...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover CVE-2025-59359の実践的なフォレンジックウォークスルーです。Chaos-Meshの重大なOSコマンドインジェクションの脆弱性について、攻撃者がGraphQLミューテーションを介してKubernetesクラスタを乗っ取る方法と、ELKを使用して侵害を検出・分析・報告する方法を学びます。 Mark Mallia 著 エグゼクティブサマリー...

CVE-2026-54246

CVE-2026-54246 affects the routesrv component of Skipper (Zalando's HTTP router and reverse proxy). Prior to version 0.27.13 , routesrv serves cluster-wide control-plane data—Ingress/RouteGroup backend URLs, filter-chain and OAuth/OIDC path details, and Redis/Valkey shard addresses—over plain HTT...

EUVD-2026-74894

A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...

CVE-2026-15140

CVE-2026-15140 is a privilege-escalation vulnerability in the Portworx Operator when deployed on Red Hat OpenShift (OCP) . During the initial provisioning of a Portworx storage cluster, under specific conditions, a user with only namespace-scoped permissions can cause the operator to grant broade...

peirates v1.1.31

Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...

CVE-2026-62440

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

EUVD-2026-63835

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

PT-2026-79328

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Access Control in the Kubernetes Service CKS plugin allows cross-tenant manipulation of the Kubernetes cluster during the process of adding and removing nodes...

GO-2023-1850 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-4102 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester...

GO-2023-1992 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2020-0012 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2023-1709 vulnerabilities

Vulnerabilities for packages: k3d...

CVE-2026-18942

A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automated process with elevated privileges, allowing the tenant to steal sensitive credentials. This could lead to a direct escalation of...

EUVD-2026-55812

A flaw was found in the Data Science Pipelines Operator DSPO. The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wi...