GHSA-3WF5-G532-RCRR Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Summary A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as...

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Summary A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in their Workflow submission. This works even when the controller is configured with templateReferencing: Strict, which is specifically documented as...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the podSpecPatch when including a podSpecPatch field in their Workflow submission. An attacker can override security restrictions defined in approved templates by submitting a workflow that includes a crafted...

CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

CVE-2026-31892

A security vulnerability in Argo Workflows (versions 2.9.0 to before 4.0.2 and 3.7.11) allows users to bypass security settings in a WorkflowTemplate by including a podSpecPatch field in a Workflow submission. The podSpecPatch field takes precedence over the referenced template and is applied wit...

CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

Argo Workflows security vulnerabilities

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions prior to Argo Workflows 4.0.2 and 3.7.11 contained security vulnerabilities. These vulnerabilities stemmed from the ability for users to bypass all security settings in the...

GO-2026-4590 Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user in github.com/rancher/rancher

Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2025-62879

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens both accessKey and secretKey into the rancher-backup-operator pod's logs...

CVE-2025-62879

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens both accessKey and secretKey into the rancher-backup-operator pod's logs...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

CVE-2025-62879

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens both accessKey and secretKey into the rancher-backup-operator pod's logs...

CVE-2025-62879 Rancher Backup Operator pod's logs leak S3 tokens

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens both accessKey and secretKey into the rancher-backup-operator pod's logs...

CVE-2025-62879 Rancher Backup Operator pod's logs leak S3 tokens

A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens both accessKey and secretKey into the rancher-backup-operator pod's logs...

Backup and Restore Operator log information leakage vulnerability

Backup and Restore Operator is an open-source Kubernetes application for backup and restoration. The Backup and Restore Operator has a vulnerability related to log information leakage, which stems from the S3 tokens being leaked into the logs of the rancher-backup-operator pod...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-kms, crossplane-provider-aws-sns, goreleaser, src, kube-rbac-proxy, dex, k3s, pulumi-language-dotnet, crossplane-provider-aws-sqs, crossplane-provider-aws-cloudwatchlogs, terraform-provider-aws, gitlab-page...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-kms, crossplane-provider-aws-sns, goreleaser, src, kube-rbac-proxy, dex, k3s, pulumi-language-dotnet, crossplane-provider-aws-sqs, crossplane-provider-aws-cloudwatchlogs, terraform-provider-aws, gitlab-page...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, gotenberg, bento-fips, ollama, apko-fips, crossplane-provider-aws-acm-fips, crossplane-provider-terraform, ksops, pluto, apache-beam-python-3.13-sdk, crossplane-provider-aws-firehose-fips, flux-operator-fips, flux-fips, goreleaser,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, gotenberg, bento-fips, ollama, apko-fips, crossplane-provider-aws-acm-fips, crossplane-provider-terraform, ksops, pluto, apache-beam-python-3.13-sdk, crossplane-provider-aws-firehose-fips, flux-operator-fips, flux-fips, goreleaser,...