provisioner

Provisioner Overview Provisioner is a developer-focused provisioning sidekick for single-board computers SBCs, particularly U-Boot-based platforms. It provides a self-contained environment to: Remotely access boards Automate bring-up workflows Provision kernels and root filesystems Execute flashi...

CVE-2025-62878

CVE-2025-62878: Local Path Provisioner Path Traversal Overview Item| Value ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 Severity| Critical CVSS 10.0 CWE| CWE-23 Relative Path Traversal Affected Component| rancher/local-path-provisioner Affected Versions| v0.0.27 v0.0.32 Fixed...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111929

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

EUVD-2026-103296

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

PT-2026-116497

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

CVE-2026-111929: Incorrect Authorization

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a...

Coder Authorization Issue Vulnerabilities

The Coder version 2.30.0 to 2.34.8 had an authorization issue vulnerability. This vulnerability stemmed from the DownloadFile gRPC handler in the provisioner daemon, which allowed unauthorized access. As a result, the authenticated provisioner daemon could download Terraform module archives store...

CLEANSTART-2026-VX47769 SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9

Security vulnerability affects the nfs-subdir-external-provisioner package. The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9...

CLEANSTART-2026-BY73125 issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input

Security vulnerability affects the nfs-subdir-external-provisioner package. An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input...

CLEANSTART-2026-WM37561 Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL

Security vulnerability affects the nfs-subdir-external-provisioner package. The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CLEANSTART-2026-NO33233 tar

Security vulnerability affects the nfs-subdir-external-provisioner package. tar...

CLEANSTART-2026-WY63823 OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go

Security vulnerability affects the nfs-subdir-external-provisioner package. OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go...

CLEANSTART-2026-DN40757 opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go

Security vulnerability affects the nfs-subdir-external-provisioner package. opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go...

CLEANSTART-2026-LJ53921 ParseAddress function constructs domain-literal address components through repeated string concatenation

Security vulnerability affects the nfs-subdir-external-provisioner package. The ParseAddress function constructs domain-literal address components through repeated string concatenation...

CLEANSTART-2026-GH89001 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients

Security vulnerability affects the nfs-subdir-external-provisioner package. clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients...

CLEANSTART-2026-KA25006 Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method

Security vulnerability affects the nfs-subdir-external-provisioner package. Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method...

CLEANSTART-2026-FV79871 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Security vulnerability affects the nfs-subdir-external-provisioner package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input...

CLEANSTART-2026-TT67272 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate

Security vulnerability affects the nfs-subdir-external-provisioner package. Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate...

CLEANSTART-2026-TK74807 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the nfs-subdir-external-provisioner package. The net/url package does not set a limit on the number of query parameters in a query...