GHSA-4XQG-GF5C-GHWQ MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting

Summary The portforward tool in mcp-server-kubernetes constructs a kubectl command as a string and splits it on spaces before passing to spawn. Unlike all other tools in the codebase which correctly use execFileSync"kubectl", argsArray, portforward uses string concatenation with user-controlled...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the APICall feature. An attacker can access sensitive internal resources and exfiltrate confidential data by supplying arbitrary URLs to the APICall feature, which are executed with elevated privilege...

Important: Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Submariner v0.22 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

External Secrets 信息泄露漏洞

External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of External Secrets 2.2.0 and earlier contain a vulnerability related to information leakage. This vulnerability stems from the v2 template engine not removing the getHostByName function, whi...

PT-2026-32965

Name of the Vulnerable Software and Affected Versions mcp-server-kubernetes versions prior to 3.5.0 Description An argument injection issue exists in the port forward tool within the startPortForward function located in src/tools/port forward.ts. The tool constructs a kubectl command using string...

BIT-TOMCAT-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

EUVD-2026-21900

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit ADK versions 1.7.0 and 2.0.0a1 through 1.28.1 and 2.0.0a2 on Python OSS, Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This...

CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit ADK versions 1.7.0 and 2.0.0a1 through 1.28.1 and 2.0.0a2 on Python OSS, Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This...

[SECURITY] Fedora 43 Update: trivy-0.69.3-1.fc43

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more...

PT-2026-32443

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

SUSE CVE-2026-35205

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. This vulnerability is fixed in 4.1.4...

MGASA-2026-0095 Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. CVE-2026-24880 Occasionally open redirect. CVE-2026-25854 TLS cipher order is not preserved. CVE-2026-29129 OCSP checks sometimes soft-fail even when soft-fail is disabled. CVE-2026-29145 EncryptInterceptor vulnerable to padding oracle attack by...

infosec-notebook

infosec-notebook Personal cybersecurity notes and references...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: nova, helm-mapkubeapis, kuma, pluto, k8ssandra-client, harbor, cerbos, kots, trivy, chartmuseum, helm-docs, helm-push, flux, trivy-operator, helm-set-status, k9s, linkerd2, tigera-operator, envoy-gateway, cert-manager-cmctl, rancher-fleet, consul-k8s, headlamp,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: gitaly, kubernetes-csi-node-driver-registrar, aws-flb-cloudwatch, gitlab-kas, nerdctl, telegraf, kube-fluentd-operator, aactl, cilium, mattermost, hubble, libnvidia-container, dask-gateway, ingress-nginx-controller, runc, datadog-agent, cert-manager, spire-server,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: gitaly, kubernetes-csi-node-driver-registrar, aws-flb-cloudwatch, gitlab-kas, nerdctl, telegraf, kube-fluentd-operator, aactl, cilium, mattermost, hubble, libnvidia-container, dask-gateway, ingress-nginx-controller, runc, datadog-agent, cert-manager, spire-server,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: slsa-verifier, incert, nerdctl, telegraf, act, helm-mapkubeapis, mailpit, rancher-machine, falcoctl, datadog-agent, karpenter, trivy, external-dns, chartmuseum, flux, chezmoi, bom, flux-helm-controller, helm-set-status, argo-cd, snyk-cli, buf, dex, tkn,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: nova, dkron, sftpgo-plugin-eventsearch, tailscale, newrelic-k8s-metadata-injection, oras, local-path-provisioner, malcontent, envoy-ratelimit, nfs-subdir-external-provisioner, aws-load-balancer-controller, dataplaneapi, smokescreen, dgraph, goreleaser,...