Backup and Restore Operator 日志信息泄露漏洞

Backup and Restore Operator is an open-source Kubernetes application for backup and restoration. The Backup and Restore Operator has a vulnerability related to log information leakage, which stems from the S3 tokens being leaked into the logs of the rancher-backup-operator pod...

PT-2026-23069

Name of the Vulnerable Software and Affected Versions Langchain Helm Charts versions prior to 0.12.71 Description Langchain Helm Charts, used for deploying Langchain applications on Kubernetes, had a flaw where a specially crafted link could lead to the theft of authentication tokens. This allowe...

Missing Encryption of Sensitive Data

Overview github.com/rancher/rancher/pkg/controllers/management/node is a complete container management platform Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the cluster creation using RKE templates with Weave CNI, where the WEAVEPASSWORD is not set,...

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

Impact This vulnerability only affects customers using Weave CNI Container Network Interface when configured through RKE templates. A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI user interface issue with RKE...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: tekton-pipelines, contour, kube-rbac-proxy, crossplane-provider-family-aws, cert-manager-webhook-pdns, crossplane-provider-aws-eks, crossplane-provider-aws-elasticache, wolfictl, crossplane-provider-aws-kms, goreleaser, pulumi-language-java, sops,...

devops-security-pipeline-poc

DevOps Security Pipeline POC A security-integrated CI/CD pipe...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: gitaly-fips, gcp-compute-persistent-disk-csi-driver-fips, teleport-operator-fips, syft-fips, kubevirt-cdi-controller-fips, cloud-provider-azure-fips, prometheus-alertmanager, argo-workflows-fips, opencost, cluster-api-provider-vsphere,...

k8s-container-escape-lkm

🛠️ Kernel Module Reverse Shell – Privileged Container Escape P...

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

This report shows a scope-widening issue in the rotate re-encrypt flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-aws, lazygit, atlantis, gitsign, crossplane-provider-azure-storage, src-fingerprint, guac, argo-workflows, crossplane-provider-aws-eks, extism, crossplane-provider-aws-elasticache, grafana, wolfictl, boring-registry,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-aws, lazygit, atlantis, gitsign, crossplane-provider-azure-storage, src-fingerprint, guac, argo-workflows, crossplane-provider-aws-eks, extism, crossplane-provider-aws-elasticache, grafana, wolfictl, boring-registry,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, nfpm, atlantis-fips, gitlab-operator-fips, terragrunt, gitaly-fips, docker-cli-buildx-fips, crossplane-provider-aws-kinesis-fips, actions-runner-controller-fips, kyverno, crossplane-provider-aws-ec2-fips, nuclei,...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.0 release

Red Hat build of OpenTelemetry 3.9.0 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: The deprecated OpenCensus Receiver, which provided backward compatibility with the OpenCensus project for easier...

CLEANSTART-2026-VU62737 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-KK99760 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the consul-k8s-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-DC63423 Within HostnameError

Multiple security vulnerabilities affect the kubernetes package. Within HostnameError. See references for individual vulnerability details...

Security Bulletin: IBM FoundationDB Operator Vulnerable to kube-apiserver vulnerability (CVE-2022-3172)

Summary IBM FoundationDB Operator addressed kube-apiserver vulnerability. Vulnerability Details CVEID:CVE-2022-3172 DESCRIPTION: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing...

CVE-2026-24005

Kruise provides automated management of large-scale applications on Kubernetes. Prior to versions 1.8.3 and 1.7.5, PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since...

CLEANSTART-2026-DN18334 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

Security vulnerability affects the kubernetes-csi-driver-nfs-fips package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have...

CLEANSTART-2026-XK29348 Security fixes for GHSA-F6X5-JH6R-WRFV, GHSA-J5W8-Q4QC-RX2X applied in versions: 8.4.0-r0

Multiple security vulnerabilities affect the kubernetes-csi-external-snapshotter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...