GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gitea, opentofu, flux-notification-controller, step-issuer, cloud-provider-aws, steampipe, trivy-operator, terraform-provider-azurerm, neuvector-sigstore-interface, pulumi-language-java, argocd-image-updater, scorecard, fscrypt, zarf, buildkitd, mods, glab, gatus,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: cerbos, frp, migrate, gitlab-cng, neuvector, undock, beats-fips, trivy-fips, rancher-agent, flux-operator-fips, terragrunt-fips, harbor-registry-fips, frankenphp-8.3, rabbitmq-messaging-topology-operator, rabbitmq-messaging-topology-operator-fips, argo-cd-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: gitea, actions-runner-controller, opentofu, flux-notification-controller, crossplane-provider-aws-kms, flux-helm-controller, crossplane-provider-aws-kinesis, trivy-operator, terraform-provider-azurerm, trufflehog, crossplane-provider-aws-cloudfront,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitea, actions-runner-controller, opentofu, flux-notification-controller, crossplane-provider-aws-kms, flux-helm-controller, crossplane-provider-aws-kinesis, trivy-operator, terraform-provider-azurerm, trufflehog, crossplane-provider-aws-cloudfront,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: actions-runner-controller, k9s-fips, nuclei, atlantis, cerbos, hydra, crossplane-provider-aws-efs-fips, pulumi-language-yaml, crossplane-provider-aws-cloudformation, crossplane-provider-aws-cognitoidentity-fips, gitaly, terraform-provider-pagerduty,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-3043

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, cerbos, migrate, glow, gitlab-cng, kubernetes-csi-livenessprobe-fips, k8s-device-plugin, neuvector, dynamic-localpv-provisioner, nri-nagios, eks-distro, azure-aad-pod-identity-mic, buf, certificate-transparency-fips, blob-csi-fips, beats-fips, undock,...

CVE-2022-24877

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: sops-fips, litestream, chezmoi, flux-kustomize-controller, sops, grafana, age, grafana-fips, flux-kustomize-controller-fips, age-fips, ksops...

GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller

Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: fulcio, step-ca, hugo-extended, py3-cassandra-medusa, trino, argo-workflows, guac, step, harbor-registry, sigstore-scaffolding, thanos, flux-image-reflector-controller, chezmoi, opentelemetry-collector, pulumi, sops, k8sgpt, restic, flux-source-controller, airflow,...

BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: frp, litefs, pulumi-language-yaml, kubernetes-csi-livenessprobe-fips, dynamic-localpv-provisioner, azure-aad-pod-identity-mic, buf, certificate-transparency-fips, timoni, kpt, rabbitmq-messaging-topology-operator, step-ca, kube-oidc-proxy, crossplane-provider-aws-sns...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, falcoctl-fips, metrics-server-fips, kubescape, cortex, kubernetes-csi-livenessprobe-fips, prometheus-stackdriver-exporter, kubernetes-csi-livenessprobe, kubevela, kiam, vault-csi-provider, src, prometheus-adapter-fips, bank-vaults-fips, aws-efs-csi-driver-fips...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: frp, nats, terraform-provider-aws, ip-masq-agent, k3d, flux-notification-controller, flux-helm-controller, bom, terraform, kpt, kubeflow-katib, terraform-provider-azurerm, pulumi-language-java, scorecard, nginx-stable, buildkitd, certificate-transparency, kubeflow, m...

Improper path handling in Kustomization files allows for denial of service

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...