CVE-2025-62878

CVE-2025-62878: Local Path Provisioner Path Traversal Overview Item| Value ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 Severity| Critical CVSS 10.0 CWE| CWE-23 Relative Path Traversal Affected Component| rancher/local-path-provisioner Affected Versions| v0.0.27 v0.0.32 Fixed...

CLEANSTART-2026-TD50332 Security fixes in local-path-provisioner-fips 0.0.36-r1

Package local-path-provisioner-fips version 0.0.36-r1 fixes 19 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-FL25724 Security fixes in local-path-provisioner-fips 0.0.36-r2

Package local-path-provisioner-fips version 0.0.36-r2 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-EY45034 Security fixes in local-path-provisioner-fips 0.0.36-r3

Package local-path-provisioner-fips version 0.0.36-r3 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-IH35596 Security fixes in local-path-provisioner 0.0.36-r1

Package local-path-provisioner version 0.0.36-r1 fixes 10 vulnerabilities: CVE-2026-39824, CVE-2025-47911, CVE-2025-58190, CVE-2026-25681, CVE-2026-27136...

GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner

Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...

CVE-2026-44543

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

EUVD-2026-32954

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543

Local Path Provisioner (rancher/local-path-provisioner) is affected. Before version 0.0.36, a user with edit rights on the local-path-config ConfigMap can inject a malicious helperPod.yaml into the template used to create HelperPods during PVC provisioning/cleanup. The attacker-controlled templat...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

Local Path Provisioner 安全漏洞

Local Path Provisioner is a Kubernetes local storage dynamic provisioning tool developed by Rancher. Versions of Local Path Provisioner prior to 0.0.36 contained security vulnerabilities. These vulnerabilities stemmed from insufficient validation of the helperPod.yaml template. Malicious users...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment during the processing of the helperPod.yaml template. An attacker can gain unauthorized access to sensitive host files, read ServiceAccount tokens from other pods, access other tenants' volume data, or...

Local Path Provisioner Vulnerable to HelperPod Template Injection

Impact A malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC...

GHSA-7FXV-8WR2-MFC4 Local Path Provisioner Vulnerable to HelperPod Template Injection

Impact A malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC...

PT-2026-39897

Name of the Vulnerable Software and Affected Versions local-path-provisioner versions prior to 0.0.36 Description A malicious user with permissions to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template. This template is used to crea...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: snyk-cli, grafana-mimir, opencost, dive, libnvidia-container, configmap-reload, gomplate, yunikorn-k8shim, crossplane-provider-azure-managedidentity, kube-metrics-adapter, witness, crossplane-provider-aws-kms, conftest, minio-operator, tekton-pipelines,...