CVE-2026-17106 vulnerabilities

Vulnerabilities for packages: podman, buildkitd, openbao, kubescape, docker-cli-buildx, skaffold, telegraf, buildah...

GHSA-HFG8-HC9C-6C3H vulnerabilities

Vulnerabilities for packages: podman, buildkitd, openbao, kubescape, docker-cli-buildx, skaffold, telegraf, buildah...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kyverno, kapp-controller, gatekeeper, cluster-api-azure-controller, vcluster, k8ssandra-client, kyverno-notation-aws, kube-vip-cloud-provider, kubernetes-csi-external-provisioner, cilium, kubescape-operator, flux-notification-controller, kwok, openbao,...

CVE-2026-17106 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, docker-cli-buildx-fips, buildah-fips, kubescape, docker-cli-buildx, buildkitd, buildah, buildkitd-fips, kubescape-server, skaffold-fips, telegraf, openbao-fips, openbao, podman, podman-fips, skaffold, ctop-fips, docker-fips...

GHSA-HFG8-HC9C-6C3H vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, docker-cli-buildx-fips, buildah-fips, kubescape, docker-cli-buildx, buildkitd, buildah, buildkitd-fips, kubescape-server, skaffold-fips, telegraf, openbao-fips, openbao, podman, podman-fips, skaffold, ctop-fips, docker-fips...

BIT-OPENBAO-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

BIT-OPENBAO-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

CVE-2026-46405

A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...

GO-2026-5213 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5526 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5192 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5609 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5192 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5609 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5526 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5213 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: cosign, runc, crossplane-provider-aws-elasticache, go-licenses, http-echo, kapp-controller, kubernetes-dns-node-cache, dask-gateway, rancher-loglevel, spark-operator, sftpgo-plugin-kms, gatekeeper, goreleaser, kubeflow, minio-operator, kserve-modelmesh-serving,...

CVE-2026-46358

A flaw was found in OpenBao. The inline authentication functionality incorrectly redacted audit log entries, causing non-authentication headers to be removed while authentication-related headers were retained in cleartext. This vulnerability requires an attacker to first compromise access to the...

CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...