GO-2026-4316 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, aws-lambda-runtime-interface-emulator-fips, custom-pod-autoscaler, aws-lambda-runtime-interface-emulator, custom-pod-autoscaler-fips, kyverno-fips, commercial-kyverno, fleet-server-fips, cloudbeat...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: supercronic, dockerize-fips, eck-operator, go-licenses, mkcert, envoy-ratelimit-fips, gosu-fips, falcosidekick, controller-gen, kyverno-policy-reporter-kyverno-plugin, crossplane-provider-aws-s3, src, multus-cni, flux, kubebuilder, apache-beam-python-3.11-sdk,...

GO-2026-4382 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-4316 vulnerabilities

Vulnerabilities for packages: custom-pod-autoscaler...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, cosign, k3s, yq, gomplate, kaf, memcached-exporter, dive, minio, oauth2-proxy, thanos-operator, kubeflow, kubernetes-csi-external-resizer, trillian, falcoctl, kubevela, vertical-pod-autoscaler, bom,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: mongo-tools, mockgen, witness, cloud-provider-gcp-cloud-controller-manager, kubernetes-csi-driver-nfs, cis-operator, nri-haproxy, rclone, wire-go, cloud-sql-proxy, undock, delve, amazon-cloudwatch-agent-operator, rabbitmq-messaging-topology-operator, k3s,...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73667 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-GR38496 Security fixes in aws-eks-pod-identity-agent 0.2.1-r1

Package aws-eks-pod-identity-agent version 0.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

EUVD-2026-56902

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw in insights-client (package insights-client-rhel9 ) in Red Hat Advanced Cluster Management for Kubernetes causes the application to log request headers—including the cloud.openshift.com pull-secret bearer token —when it receives a non-200 response. A local user with access to pod logs on t...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

EUVD-2026-56898

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...