kstg

OWASP KSTG Guía de Pruebas de Seguridad de Kubernetes de OWASP Nuestra Visión Crear un manual integral para la evaluación de seguridad de clústeres de Kubernetes Estamos creando una guía integral de pruebas para la evaluación de seguridad de clústeres de Kubernetes que cubre un enfoque de arriba...

vex8s

Vex8s （此徽标并非 AI 生成） Vex8s 通过将容器漏洞与 Kubernetes 设置相关联，生成 VEX 文档，以确定哪些 CVE 在您的集群中实际可利用。 请注意，这是一个实验性项目。内容可能会快速变化。 工作原理 该项目旨在通过结合漏洞分类和 securityContext 分析，评估 Kubernetes 工作负载中已知 CVE 的可利用性。 它基于以下概念： 每个 CVE 被归类为一个或多个漏洞类别（CWE） CVE 描述由嵌入式 ML 模型 处理，以预测其 利用类别。 CWE 和预测的 利用类别 相结合，以确定 CVE 是否可缓解。 每个 利用类别...

kubernetes-goat

Kubernetes Goat ✨ Kubernetes Goat 旨在成为一个故意存在漏洞的集群环境，用于学习和实践 Kubernetes 安全性 🚀 🙌 请参阅 https://madhuakula.com/kubernetes-goat 获取指南 📖 🧰 设置 Kubernetes Goat 确保你拥有集群的管理员权限并安装了 kubectl。请参阅 安装文档 确保你安装了 helm 包管理器。请参阅 安装文档 要在你的集群中设置 Kubernetes Goat 资源，运行以下命令： root@kitploit: git clone...

stackrox

目录 StackRox Kubernetes 安全平台 目录 社区 部署 StackRox 使用 Helm 快速安装 使用 Helm 手动安装 使用 Operator 安装 通过脚本安装 Kubernetes 发行版 EKS, AKS, GKE OpenShift Docker Desktop、Colima 或 minikube 访问 StackRox 用户界面 UI 开发 快速开始 构建工具 克隆 StackRox 本地开发 常用 Makefile 目标 生产力 GoLand 配置 运行 sqlintegration 测试 调试 生成便携安装程序 运行 StackRox 的依赖和建议...

opa

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

starboard

Starboard 正在加入 Trivy。 我们已宣布计划停止 Starboard 并将其合并到 Trivy 中。 Starboard CLI 已重新引入为 trivy kubernetes 命令，而专注于 trivy 能力的 starboard-operator 可作为 Trivy-Operator 使用。 我们将不再接受新功能/拉取请求/问题。 我们鼓励您为 Trivy-Operator 和 Trivy CLI 做出贡献，并影响 Trivy Kubernetes 的未来。 有关更多信息，请参阅 讨论 查看最新：Trivy 下一步问答 Kubernetes 原生安全工具包。 简介...

tarian

Tarian 通过预先注册受信任的进程和受信任的文件签名，保护运行在 Kubernetes 上的应用程序免受恶意攻击。Tarian 会检测未知进程和对已注册文件的更改，然后发送告警并采取自动化操作。保护您的 K8s 环境免受勒索软件侵害！ 我们希望将此项目作为开源项目维护，以对抗针对我们最喜爱的 Kubernetes 生态系统的攻击。通过持续贡献，我们可以作为社区共同应对威胁。 Tarian 是如何工作的？ Tarian 集群代理运行在 Kubernetes 集群中，检测未知进程和对文件的未知更改，将其报告给 Tarian 服务器，并可选择采取操作：删除违规的 Pod。它使用 eBPF...

kubescape v4.0.13

Kubescape Comprehensive Kubernetes Security from Development to Runtime Kubescape is an open-source Kubernetes security platform that pr...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: kargo, gitness, eksctl, argocd-image-updater, helm-operator, cilium-cli, manifest-tool, kyverno, gatekeeper, zarf, helm-set-status, kubescape, kube-arangodb, rancher-fleet, oras, rancher-helm, teleport, falcoctl, linkerd2, cert-manager-cmctl, trivy-operator,...

CVE-2026-9165

Summary : A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central allows unbounded GraphQL query depth on the authenticated GraphQL API, enabling a token-authenticated user to issue deeply nested queries that exhaust resources and cause a denial of service to the management pla...

EUVD-2026-36287

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectlgeneric tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes...

CVE-2026-50570

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs ValidatePodSpecSafety /...

CVE-2026-46618 Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command...

SUSE-SU-2026:2339-1 Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265740. - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service...

PT-2026-46125

Name of the Vulnerable Software and Affected Versions Enterprise Gateway affected versions not specified Description Server Side Template Injection SSTI occurs during the rendering of Kubernetes manifests when using Jinja2, a template engine for Python. By including template expressions in...

Kubernetes Security Scanning: A DevSecOps Guide

A clean container image is not proof of a secure Kubernetes workload. New CVEs, unsafe configurations, and excessive permissions can turn an approved deployment into an active exposure. Contact Hive Pro to review your Kubernetes container security priorities. Kubernetes security scanning is the...

GHSA-FQW6-GF59-QR4W containerd user ID handling bypass allows runAsNonRoot evasion

Impact A bug was found in containerd where containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via improper handling of numeric User directives in container configuration. An attacker can gain elevated privileges by supplying a crafted image with an /etc/passwd file that...

SPARK: Secure Predictive Autoscaling for Robust Kubernetes

Achieving high availability and robust security in Kubernetes requires more than reactive scaling and standard perimeter firewalls. Traditional autoscalers, such as HPA, often fail to react quickly to traffic spikes and cannot distinguish between legitimate flash crowds and DDoS attacks. We prese...

Kubernetes（K8s） 安全漏洞

Kubernetes K8s is an open-source system developed under the Kubernetes project, used for automated deployment, scaling, and management of containerized applications. There is a security vulnerability in Kubernetes K8s, which stems from insufficient validation of the subDir parameter in volume...