GO-2026-5774 vulnerabilities

Vulnerabilities for packages: cosmo-router, zitadel, kyverno, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, karma, telegraf, commercial-kyverno, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: cosmo-router, zitadel, kyverno, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, karma, telegraf, commercial-kyverno, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: cosmo-router, zitadel, kyverno, karma-fips, cosmo-router-fips, fluxcd-kustomize-mutating-webhook, karma, telegraf, commercial-kyverno, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kube-vip-cloud-provider, kubeflow-pipelines, gitness, blobfuse2, crossplane-provider-aws-ec2, manifest-tool, aws-flb-kinesis, mods, whereabouts, descheduler, octo-sts, fuse-overlayfs-snapshotter, slsa-verifier, langfuse, tfsec, pgpool2exporter, clickhouse-operator,...

CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

PT-2026-66831

Name of the Vulnerable Software and Affected Versions vault-secrets-webhook versions prior to 1.23.1 Description The software reads the vault.security.banzaicloud.io/vault-addr annotation from ConfigMaps or Secrets without validation or allowlisting. When a value prefixed with vault: is present,...

CVE-2026-44949 Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook

A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submi...

CVE-2026-44949 Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook

A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to the in-cluster rancher-webhook service could submi...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dkron, malcontent, osv-scanner, temporal, dataplaneapi, newrelic-k8s-metadata-injection, flux-source-controller, flux-image-reflector-controller, clickhouse-operator, ingress-nginx-controller, kubewatch, external-secrets-operator, rabbitmq-messaging-topology-operator...

EUVD-2026-17133

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4 , the mutating webhook and kubeconfiggenerator components are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the chartURL field in ResourceComposition resources. Furthermore, because the kubeconfiggenerator directly concatenates this field int...

CVE-2026-29954: Improper Neutralization of Argument Delimiters in a Command

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

KubePlus 安全漏洞

KubePlus is a Kubernetes multi-tenant application management platform developed by cloud-ark. KubePlus 4.1.4 contains security vulnerabilities, which stem from server-side request forgery and command injection during the processing of the chartURL field by the mutating webhook and...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: cloudnative-pg, fulcio, victoriametrics-cluster, restic, vt-cli, gotestsum, grpcurl, apko, step-ca, sftpgo-plugin-kms, tflint, logstash, amass, kubescape, trivy, helm-operator, caddy, ghaudit, temporal, aws-node-termination-handler, kubecolor, aws-nuke, nri-mysql,...