59418 matches found
CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...
CVE-2026-47768 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL Referer, history, proxy logs. This issue has been patched in version 0.3.2...
CVE-2026-47768
CVE-2026-47768 affects nebula-mesh up to and including v0.3.1, where newly minted operator API keys are exposed in the redirect URL?new_key and related query strings. The root cause is tokens being placed in the URL during the handleOperatorCreateAPIKey flow, making them observable via the browse...
CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
EUVD-2026-49942
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...
CVE-2026-47726
CVE-2026-47726 (nebula-mesh) affects nebula-mesh prior to v0.3.2. The handleGetAuditLog endpoint in internal/api/audit.go does not enforce an admin check, allowing any operator API key with bearer authentication to retrieve the full audit log via store.ListAuditEntries (limit 1000). Exposed data ...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: camunda-zeebe, spark-fips, opensearch, strimzi-kafka-operator, strimzi-kafka-operator-fips, apache-hop, spark, opensearch-fips, apache-hop-fips, camunda...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: camunda-zeebe, spark-fips, opensearch, strimzi-kafka-operator, strimzi-kafka-operator-fips, apache-hop, spark, opensearch-fips, apache-hop-fips, camunda...
GHSA-HPCC-26XQ-25FV vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, spark, opensearch...
CVE-2026-56816 vulnerabilities
Vulnerabilities for packages: strimzi-kafka-operator, spark, opensearch...
BIT-OPENBAO-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-resizer, argocd-image-updater, crossplane, metallb, opentelemetry-operator, yunikorn-k8shim, datadog-operator, kube-vip-cloud-provider, telegraf, kapp-controller, kube-metrics-adapter, kyverno, pulumi-kubernetes-operator, rancher-system-agent,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: descheduler-fips, omnictl-multiarch, kubernetes-csi-external-provisioner-fips, karpenter, cloud-provider-gcp-cloud-controller-manager, kyverno-fips, rancher-support-bundle-kit, seaweedfs-operator, kubescape-server, elastic-agent, k8s-agents-operator,...
CVE-2026-54696 vulnerabilities
Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset, logstash...