Important: Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.2.1

external secrets operator for Red Hat OpenShift 1.2.1 The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager,...

CVE-2026-80351

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80354

An authorization vulnerability in Apache Camel K (versions 2.0.0 to 2.9.3 and 2.10.1 to 2.10.2 ) allows a tenant to bypass security controls via custom resource resolution. An attacker can reference secrets by name within the operator namespace , potentially exposing sensitive secrets belonging t...

CVE-2026-80354 Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. Th...

EUVD-2026-75292

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. Th...

EUVD-2026-75291

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351

Apache Camel K is vulnerable to an eval injection vulnerability caused by improper neutralization of directives in dynamically evaluated Maven configuration. This flaw allows tenant-controlled repository content to influence code execution within the operator pod , potentially enabling tenants to...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

CLEANSTART-2026-RC17482 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the minio-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-DB46993 Prometheus is an open-source monitoring system and time series database

Multiple security vulnerabilities affect the prometheus-operator package. Prometheus is an open-source monitoring system and time series database. See references for individual vulnerability details...

CLEANSTART-2026-CT24188 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-XP64749 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CVE-2026-80351: Improper Neutralization of Directives in Dynamically Evaluated Code

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

PT-2026-89512

Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an explicit equality filter to be interpreted as a query condition rather than as a literal value. This affects the three-argument where method when the operator i...

CVE-2026-84303 vulnerabilities

Vulnerabilities for packages: vcluster, grafana-mimir, kubernetes-csi-external-provisioner, mcp-grafana, helm, gcp-compute-persistent-disk-csi-driver, trillian, istio, falco-exporter, kuma, kubeflow, cerbos, k8s-device-plugin, blob-csi, knative-serving, gitlab-runner, hydra, knative-eventing,...

GHSA-QC2Q-P7WX-3PX3 vulnerabilities

Vulnerabilities for packages: vcluster, grafana-mimir, kubernetes-csi-external-provisioner, mcp-grafana, helm, gcp-compute-persistent-disk-csi-driver, trillian, istio, falco-exporter, kuma, kubeflow, cerbos, k8s-device-plugin, blob-csi, knative-serving, gitlab-runner, hydra, knative-eventing,...