GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: kots, zarf, zot, cosign, conftest, policy-controller, k8sgpt, kubescape, snyk-cli, spire-server, opa, tfsec...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: restic, terraform-docs, vcluster, rqlite, pulumi-language-dotnet, temporal, sigstore-scaffolding, kaniko, grafana-agent-operator, ferretdb, tflint, grafana-mimir, dbmate, kots, ksops, spegel, gomplate, kargo, minio, k8sgpt, zot, dex, kube-rbac-proxy, fulcio,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kind, prometheus, render-template, aws-eks-pod-identity-agent, envconsul, nri-memcached, docker-credential-gcr, rancher-system-upgrade-controller, undock, nri-mysql, cloud-provider-vsphere, kubernetes-dashboard, wal-g, nri-consul, migrate, zot, k8sgateway, polaris,...

CVE-2026-73285

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285

RustFS (distributed object storage in Rust) up to version 1.0.0-rc.1 is affected. The external OPA authorization configured via RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs incorrectly sets PreparedIamAuth.needs_existing_object_tag for PreparedIamMode::Opa, which can cause maybe_merge_object...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

CVE-2026-73285: Incorrect Authorization

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5. A patched version of the package is available...

EUVD-2026-48437

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

CVE-2026-65604: Improper Input Validation

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

AZL-93273 CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-50197

Summary: CVE-2026-50197 affects zalando/skipper’s OpenPolicyAgent integration. When clients use HTTP/1.1 Transfer-Encoding: chunked or HTTP/2 without Content-Length, the opaAuthorizeRequestWithBody flow exposes an empty raw_body and parsed input.parsed_body to OPA, causing policy checks that rely...

PT-2026-91455

Name of the Vulnerable Software and Affected Versions Skipper versions prior to 0.27.35 Description An issue exists in the opaAuthorizeRequestWithBody filter within filters/openpolicyagent/openpolicyagent.go where requests with a declared Content-Length exceeding the...