CLEANSTART-2026-XE28379 Security fixes in rabbitmq-messaging-topology-operator 1.19.3-r0

Package rabbitmq-messaging-topology-operator version 1.19.3-r0 fixes 4 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-SC78735 Security fixes in minio-operator 6.0.4-r5

Package minio-operator version 6.0.4-r5 fixes 4 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2024-51744...

CLEANSTART-2026-YT10407 Security fixes in prometheus-operator-fips 0.85.0-r1

Package prometheus-operator-fips version 0.85.0-r1 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-BN98240 Security fixes in fluent-operator-fips 3.3.0-r7

Package fluent-operator-fips version 3.3.0-r7 fixes 4 vulnerabilities: CVE-2026-27139, CVE-2025-61730, CVE-2026-27142, CVE-2025-61728...

EUVD-2026-51032

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CVE-2026-44097

The CVE-2026-44097 entry describes a low-privileged remote attacker with operator access who can upload arbitrary files through the firmware-update REST endpoint, leading to persistent attacker-controlled data and potential DoS via resource exhaustion. The root cause is an unrestricted file uploa...

CVE-2026-15240

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-15240

The CVE refers to the Customer Switching for WooCommerce plugin for WordPress, affected in versions before 2.1.3. The root cause is insecure binding of an active user-switching session to the initiating operator, allowing a lower-privilege account that an operator is switched into to be resolved ...

PT-2026-66460

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

PT-2026-66461

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client id and clien...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680

The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...

CVE-2026-16543

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

CVE-2026-16543

Kong Operator’s embedded Kong Kubernetes Ingress Controller (KIC) is vulnerable. A user with namespace-scoped Secret creation privileges can cause a cluster-wide denial of service by collecting CA-certificate Secrets across watched namespaces using only a label selector, with no ingress-class or ...