CVE-2026-17106 vulnerabilities

Vulnerabilities for packages: kubescape, openbao, telegraf, docker-cli-buildx, buildkitd, podman, skaffold, buildah...

GHSA-HFG8-HC9C-6C3H vulnerabilities

Vulnerabilities for packages: kubescape, openbao, telegraf, docker-cli-buildx, buildkitd, podman, skaffold, buildah...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cilium, crossplane, telegraf, kots, kubernetes-csi-external-snapshotter, cluster-api-aws-controller, node-feature-discovery, kubernetes-csi-external-provisioner, flux-helm-controller, yunikorn-k8shim, istio, tkn, external-secrets-operator, cert-manager-webhook-pdns,...

CVE-2026-17106 vulnerabilities

Vulnerabilities for packages: openbao, docker-fips, podman, skaffold-fips, podman-fips, skaffold, ctop-fips, buildkitd, buildah, telegraf, buildkitd-fips, kubescape-server-fips, openbao-fips, buildah-fips, kubescape, docker-cli-buildx, kubescape-server, docker-cli-buildx-fips...

GHSA-HFG8-HC9C-6C3H vulnerabilities

Vulnerabilities for packages: openbao, docker-fips, podman, skaffold-fips, podman-fips, skaffold, ctop-fips, buildkitd, buildah, telegraf, buildkitd-fips, kubescape-server-fips, openbao-fips, buildah-fips, kubescape, docker-cli-buildx, kubescape-server, docker-cli-buildx-fips...

BIT-OPENBAO-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...

BIT-OPENBAO-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...

CVE-2026-46405

A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...

GO-2026-5526 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5213 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5192 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5609 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5609 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5192 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5526 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-5213 vulnerabilities

Vulnerabilities for packages: openbao...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, kube-logging-operator-custom-runner, terraform-provider-time, kbld, falcosidekick, rabbitmq-messaging-topology-operator, tfsec, vertical-pod-autoscaler, ferretdb, newrelic-fluent-bit-output, pgpool2exporter,...

CVE-2026-46358

A flaw was found in OpenBao. The inline authentication functionality incorrectly redacted audit log entries, causing non-authentication headers to be removed while authentication-related headers were retained in cleartext. This vulnerability requires an attacker to first compromise access to the...

CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...