EUVD-2026-57435

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-16456 Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy

A flaw was found in the odh-model-controller. An authenticated user with permissions to create custom resources can exploit a vulnerability in the loadSecret function. This function improperly reads the Secret namespace from user-controlled input without validation. This allows an attacker to rea...

CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13442

Langflow OSS versions 1.0.0–1.10.1 are affected by CVE-2026-13442. An attacker could reuse another user’s FAISS namespace to access owner‑only vector content and influence later query results, enabling cross‑user information disclosure and limited integrity impact via persistent poisoning of resu...

Linux Distros Unpatched Vulnerability : CVE-2026-64137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: require net admin for CIFS SWN netlink CIFSGENLCMDSWNNOTIFY is the userspace witness- notify command. The intended sender is the cifs.witness helpe...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the valuesFrom process. An attacker can gain unauthorized access to secrets and config maps across namespaces by crafting resources such as HelmOp or Bundle with references to arbitrary secrets, provided they...

CVE-2026-13434

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or...

CVE-2026-13434

CVE-2026-13434 affects KubeVirt’s network annotation generator used when provisioning VirtualMachineInstance with Multus networks. The flaw writes the supplied networkName verbatim into the v1.multus-cni.io/default-network annotation without format validation or sanitization, with only an empty-s...

EUVD-2026-39796

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or...

CVE-2026-13434

A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuration, the supplied networkName value is written verbatim into the launcher pod's v1.multus-cni.io/default-network annotation without format validation or...

GO-2026-5615 CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3

CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3...

GO-2026-5573 Apache Camel K: Kubernetes namespace authorized users can create a Build resource in github.com/apache/camel-k

Apache Camel K: Kubernetes namespace authorized users can create a Build resource in github.com/apache/camel-k...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the evaluation of the crossProviderNamespaces allowlist within the Kubernetes Gateway provider. An attacker can gain unauthorized access to internal services by creating an HTTPRoute in a non-allow-listed...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the KubernetesWatchTrigger process. An attacker can gain unauthorized access to sensitive events from other namespaces by creating a KubernetesWatchTrigger in their own namespace, enabling persistent surveillan...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the Function admission webhook due to lack of namespace validation for the PackageRef.Namespace field. An attacker can access package data from other namespaces by submitting a crafted function specification...

CVE-2026-44424

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace tenant. Any authenticated user JWT or API Key who knows or can guess a device UID...

EUVD-2026-32748

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link symlink within an exported filesystem Persistent Volume Claim PVC that points...

CVE-2026-9804

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link symlink within an exported filesystem Persistent Volume Claim PVC that points...

PT-2026-44221

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.8.3-1.1 Description A path traversal flaw exists in the virt-exportserver component. An attacker with namespace-level access can exploit the 'VMExport directory' endpoint by placing a symbolic link symlink within a...