CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-66787 Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

GO-2026-6238 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, agentbeat, nerdctl-fips, witness, virt-handler, docker, beats, hubble-fips, splunk-otel-collector-fips, containerd-fips, rke2-runtime-fips, kubescape-server-fips, cilium, envoy-gateway-fips, gitaly, cosmo-router, nerdctl, falcoctl, hubble-ui, kuma...

CVE-2026-73499 vulnerabilities

Vulnerabilities for packages: kine, dapr...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-aws-s3, crossplane-provider-aws-kms, hugo, crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, crossplane-provider-aws-sqs, kubevela, crossplane-provider-azure-authorization,...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-aws-s3, crossplane-provider-aws-kms, hugo, crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, crossplane-provider-aws-sqs, kubevela, crossplane-provider-azure-authorization,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kapp-controller, kube-rbac-proxy, flux-notification-controller, spicedb, tetragon, cloud-provider-vsphere, rancher-system-agent, emissary, tkn, rancher, tekton-pipelines, kubernetes-csi-external-snapshotter, cloud-provider-gcp-cloud-controller-manager,...

CVE-2026-73500 affecting package kubernetes for versions less than 1.30.10-28

CVE-2026-73500 affecting package kubernetes for versions less than 1.30.10-28. A patched version of the package is available...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update

Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update

Red Hat Advanced Cluster Management for Kubernetes v2.16 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

CVE-2026-18544 Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: cilium-cli, external-dns, kine, multicluster-controlplane, kyverno, cert-manager, reports-server, kubernetes, dapr, cilium, commercial-grafana, multicluster-controlplane-fips, minio, milvus, rancher-support-bundle-kit, kots, hubble, kube-conformance, loki...

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2026-50149

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.53 bug fix and security update

Red Hat OpenShift Container Platform release 4.18.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

CVE-2026-50149

Contour (Kubernetes ingress controller using Envoy proxy) versions 1.23.0 through 1.33.4 contain a JWT verification bypass . When an HTTPProxy resource is configured with both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour accepts the incompatibl...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...