Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

cert-manager Operator for Red Hat OpenShift 1.18.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1

cert-manager Operator for Red Hat OpenShift 1.18.1 The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide certificates-as-a-service to...

Azure Linux 3.0 Security Update: containerd2 (CVE-2025-47291)

The version of containerd2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-47291 advisory. - containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation...

Azure Linux 3.0 Security Update: kubernetes (CVE-2025-0426)

The version of kubernetes installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-0426 advisory. - A security issue was discovered in Kubernetes where a large number of container checkpoint requests made ...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

CVE-2026-23990 affects the Flux Operator Web UI in Flux CD/ControlPlane prior to 0.40.0. The issue is a privilege-escalation through an impersonation bypass when OIDC tokens provide empty/invalid claims that CEL expressions can evaluate to empty; then Kubernetes client-go fails to add impersonati...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

GHSA-4XH5-JCJ2-CH8Q Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

A privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows an attacker to bypass Kubernetes RBAC impersonation and execute API requests with the operator's service account privileges. After OIDC token claims are processed through CEL expressions, there...

CVE-2026-23528 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

GHSA-58PV-8J8X-9VJ2 vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-katib, superset, py3-cassandra-medusa, py3-setuptools, datadog-agent, mlflow, kserve, dask-kubernetes, kubeflow-jupyter-web-app, pypy-3.10, emissary, airflow, semgrep, pypy-3.11...

GHSA-C336-7962-WFJ2 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

GHSA-58PV-8J8X-9VJ2 vulnerabilities

Vulnerabilities for packages: authentik-fips, pypy-3.11, dask-kubernetes, py3-setuptools, kubeflow-katib, localstack, tensorflow-gpu-jupyter, ansible-operator, duplicity, nemo, awx, py3-cassandra-medusa, opal, datadog-agent-fips, py3.9-setuptools, label-studio, ansible-operator-fips,...

GHSA-C336-7962-WFJ2 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

CVE-2026-23528 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

PT-2026-3870

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.6.17 and prior to 3.7.8 Description Argo Workflows contains a stored cross-site scripting XSS issue in the artifact directory listing. This allows a workflow author to execute arbitrary JavaScript in another...

External Secrets Security Vulnerabilities

External Secrets is an open-source Kubernetes-related application developed by External Secrets. There were security vulnerabilities in versions 0.20.2 to 1.2.0 of External Secrets. These vulnerabilities stemmed from the getSecretKey template function, which allowed access to secrets across...

CVE-2026-23490 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, open-webui, kubeflow-katib, py3-cassandra-medusa, kubeflow-pipelines, k8s-sidecar, kubeflow-volumes-web-app, kserve, mlflow, dask-kubernetes, kubeflow-jupyter-web-app, airflow...

GHSA-63VM-454H-VHHQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, open-webui, kubeflow-katib, py3-cassandra-medusa, kubeflow-pipelines, k8s-sidecar, kubeflow-volumes-web-app, kserve, mlflow, dask-kubernetes, kubeflow-jupyter-web-app, airflow...

GHSA-63VM-454H-VHHQ vulnerabilities

Vulnerabilities for packages: authentik-fips, dask-kubernetes, kubeflow-katib, kubeflow-pipelines-visualization-server, localstack, k8s-sidecar, ansible-operator, duplicity, py3-cassandra-medusa, kubeflow-volumes-web-app, label-studio, gitlab-cng, ansible-operator-fips, metaflow-service,...