EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569

mce-operator-bundle (Red Hat) contains a build-time supply chain flaw: the bundle-generation process fetches business logic from the mutable branch stolostron/release@master without commit pinning or signature verification. An attacker with write access to that remote repository can inject arbitr...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-76139

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-75569

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

Files Or Directories Accessible To External Parties

Apache Flink Kubernetes Operator is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to insufficient validation of the FlinkSessionJob jarURI, including missing scheme, host, and IP-range restrictions, which allows users with CR create permissions to rea...

CVE-2026-70496 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496 Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

EUVD-2026-62678

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496

The search-v2-operator ClusterRole grants cluster-admin-equivalent privileges (impersonation, RBAC write, CSR approval, ManifestWork management), enabling privilege escalation. No exploitation details or patch versions are provided in the documents; monitor Red Hat advisories for remediation guid...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-71470

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

EUVD-2026-62590

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470 Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71470

In ACM search-v2-operator, CR editor fields (imageOverride, arguments, env vars) are unsanitized into pods running under an impersonation ServiceAccount, enabling arbitrary secret mounting or container image replacement for privilege escalation and full cluster compromise. Red Hat advises restric...

CVE-2026-71470

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-76240

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...