GO-2026-4316 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, commercial-kyverno, custom-pod-autoscaler, fleet-server-fips, custom-pod-autoscaler-fips, kyverno-fips, cloudbeat, aws-lambda-runtime-interface-emulator, aws-lambda-runtime-interface-emulator-fips...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, trivy, kine, docker-credential-acr-env, kube-logging-logging-operator, vertical-pod-autoscaler-fips, tfsec, guac, k8s-device-plugin, yam, nri-cassandra, docker-compose, opa-fips, crossplane-provider-aws-dynamodb, tigera-operator-fips...

GO-2026-4382 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-4316 vulnerabilities

Vulnerabilities for packages: custom-pod-autoscaler...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, vertical-pod-autoscaler, kpt, kubeflow, grpcurl, hugo, vault-k8s, kube-fluentd-operator, flux, kubernetes-dashboard-metrics-scraper, prometheus-alertmanager, crossplane-provider-azure, hey, gitness, k3d, kubernetes-csi-livenessprobe,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kpt, nats-server-config-reloader, witness, cni-plugins, cloud-provider-gcp-cloud-controller-manager, containerd, ipfs-cluster, flux, terraform-mcp-server, chart-testing, wgcf, nri-memcached, wal-g, portieris, k3d, gcsfuse, nri-nginx,...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73667 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-GR38496 Security fixes in aws-eks-pod-identity-agent 0.2.1-r1

Package aws-eks-pod-identity-agent version 0.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

EUVD-2026-56902

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw in insights-client (package insights-client-rhel9 ) in Red Hat Advanced Cluster Management for Kubernetes causes the application to log request headers—including the cloud.openshift.com pull-secret bearer token —when it receives a non-200 response. A local user with access to pod logs on t...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

EUVD-2026-56898

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...