CVE-2026-110744

A vulnerability exists in multicluster-global-hub-operator-bundle due to overly broad role-based access control (RBAC) permissions. This flaw allows for unrestricted, cluster-wide impersonation of arbitrary users, groups, and service accounts. An attacker who successfully compromises the operator...

EUVD-2026-107418

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-110744 Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-110744

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

PT-2026-120727

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

EUVD-2026-104989

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-113620

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1 , a vulnerability exists where operator WebSocket upgrades on the exec and log routes fail to verify the bearer JWT . The system decodes the payload and uses the contained groups or roles as RBAC subjects . An attacker can provide a self-mi...

CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-105311

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311 Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters.credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUse...

CVE-2026-105311

The StreamsHub Console operator is vulnerable to a confused deputy attack due to a lack of same-namespace checks. A Kubernetes tenant with permission to create a Console custom resource can specify an arbitrary namespace in spec.kafkaClusters[].credentials.kafkaUser.namespace. Because the operato...

Eclipse ioFog encryption issue vulnerability

Versions 3.8.0 through 3.9.1 of Eclipse ioFog contain an encryption-related vulnerability. This vulnerability arises from the operator WebSocket upgrade for exec and log routes failing to validate bearer JWTs; additionally, groups or roles defined in the decoded payload are used as RBAC subjects...

PT-2026-118360

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-112047

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

EUVD-2026-103509

OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident A...

CVE-2026-112047

OneUptime versions 14.0.2 before 14.0.69 are vulnerable to an incorrect authorization flaw (CWE-863) within Kubernetes AI Actions . This vulnerability occurs because project-wide permission checks can be exploited by authenticated project members to perform actions on clusters outside their inten...