55 matches found
CVE-2025-62878
CVE-2025-62878: Local Path Provisioner Path Traversal Overview Item| Value ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 Severity| Critical CVSS 10.0 CWE| CWE-23 Relative Path Traversal Affected Component| rancher/local-path-provisioner Affected Versions| v0.0.27 v0.0.32 Fixed...
GO-2026-6865 vulnerabilities
Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...
CVE-2026-116591 vulnerabilities
Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...
GHSA-FPMH-FRQ8-7RJ8 vulnerabilities
Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...
ROS-20260922-73-0113
The vulnerability in golang-github-rancher-local-path-provisioner is related to errors in handling relative pathnames to the directory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
ROS-20260921-73-0108
The vulnerability in golang-github-rancher-local-path-provisioner is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to increase their privileges...
CLEANSTART-2026-FL25724 Security fixes in local-path-provisioner-fips 0.0.36-r2
Package local-path-provisioner-fips version 0.0.36-r2 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...
CLEANSTART-2026-TD50332 Security fixes in local-path-provisioner-fips 0.0.36-r1
Package local-path-provisioner-fips version 0.0.36-r1 fixes 19 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...
CLEANSTART-2026-EY45034 Security fixes in local-path-provisioner-fips 0.0.36-r3
Package local-path-provisioner-fips version 0.0.36-r3 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...
SUSE CVE-2026-44543
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
CLEANSTART-2026-IH35596 Security fixes in local-path-provisioner 0.0.36-r1
Package local-path-provisioner version 0.0.36-r1 fixes 10 vulnerabilities: CVE-2026-39824, CVE-2025-47911, CVE-2025-58190, CVE-2026-25681, CVE-2026-27136...
GO-2026-5218 Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner
Local Path Provisioner Vulnerable to HelperPod Template Injection in github.com/rancher/local-path-provisioner...
K000161495: Rancher Local Path Provisioner vulnerability CVE-2025-62878
Security Advisory Description A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. CVE-2025-62878 Impact There is no impact; F5 products...
CVE-2026-44543
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
CVE-2026-44543
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
EUVD-2026-32954
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...
CVE-2026-44543
Local Path Provisioner (rancher/local-path-provisioner) is affected. Before version 0.0.36, a user with edit rights on the local-path-config ConfigMap can inject a malicious helperPod.yaml into the template used to create HelperPods during PVC provisioning/cleanup. The attacker-controlled templat...
CVE-2026-44543
Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...