30 matches found
cve-2023-5044
CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is a quick Go program to exploit the recent CVE in the Ingress Nginx controller. Details on how to do this are already out there via Rory McCune's blog at https://raesene.github.io/blog/2023/10/29/exploiting-CVE-2023-5044/, this just...
CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
EUVD-2026-101606
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999
The Radius Kubernetes controller (versions 0.57.1 and earlier) is vulnerable to a Confused Deputy attack due to improper input validation in the deserialization of the radapp.io/status annotation on Kubernetes Deployments. The controller fails to verify if the resource IDs provided in this user-c...
CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999 Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
CVE-2026-53999: Improper Input Validation
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...
Malicious code in kubernetes-controller-tools (npm)
Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code. --- Credit: OpenSSF source...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: rancher-fleet, teleport, kubescape-server-fips, ocm-cli-fips, kots, conftest, gitlab-operator-fips, rancher, xeol-fips, chartmuseum-fips, helm-push, zarf, ocm-kubernetes-controller, crossplane, ocm-cli, opentofu, steampipe, zarf-fips, rancher-fleet-fips,...
GO-2026-5885 vulnerabilities
Vulnerabilities for packages: rancher-fleet, teleport, kubescape-server-fips, ocm-cli-fips, kots, conftest, gitlab-operator-fips, rancher, xeol-fips, chartmuseum-fips, helm-push, harvester, zarf, ocm-kubernetes-controller, crossplane, ocm-cli, opentofu, harvester-fips, steampipe, zarf-fips,...
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
GHSA-R6J8-C6R2-37RR kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the kube-controller-manager when using the in-tree Portworx StorageClass. An attacker can access sensitive information from unprotected endpoints within the control plane's host network, including...
CVE-2025-13281 Portworx Half-Blind SSRF in kube-controller-manager
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
EUVD-2025-200056
Malicious code in kubernetes-controller-tools npm...
MAL-2025-191513 Malicious code in kubernetes-controller-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...
Malicious code in kubernetes-controller-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42961dff6a9f6fd9e6dce1e6906ba8e15d64622a3856a65dc61ec9fd6974252b The package kubernetes-controller-tools was found to contain malicious code...