CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: redpanda-console, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, flux, grype, crossplane-fips, terragrunt, xeol-fips, trivy-operator-fips, argo-workflows-fips, chainloop-cli-fips, steampipe, jfrog-cli, kargo, coder-fips, crossplane, scorecard,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: redpanda-console, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, flux, grype, crossplane-fips, terragrunt, xeol-fips, trivy-operator-fips, argo-workflows-fips, chainloop-cli-fips, steampipe, jfrog-cli, kargo, coder-fips, crossplane, scorecard,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: datadog-agent, k3s, witness, goreleaser, grafana-alloy, loki, prometheus, rclone, vcluster, kubevela, gitlab-runner, cri-tools, maru, minio, nuclei, redpanda, opentelemetry-collector-contrib, ollama, teleport, k8sgpt, weaviate, eksctl, opentelemetry-collector,...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

EUVD-2023-34868

Malicious code in bioql PyPI...

EUVD-2023-28634

Malicious code in bioql PyPI...

EUVD-2023-55703

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: verticadb-operator-fips, cert-manager-csi-driver, k6-fips, opentelemetry-collector-fips, consul-k8s, kubescape-operator-fips, dagger, amazon-k8s-cni, harbor-scanner-trivy-fips, fluxcd-kustomize-mutating-webhook, fulcio, slsa-verifier, etcd, knative-serving-fips,...

CVE-2023-30450

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpcservertls field, leading to for example situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure while a cluster is turned off in order to have TLS on broker RPC ports...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

Authorization

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

Redpanda Security Vulnerabilities

Redpanda is a streaming data platform for developers. It is compatible with the Kafka API. Redpanda has a security vulnerability that stems from a lack of authorization checks in the Transactions API. Affected products and versions: Redpanda versions before 23.1.21, 23.2.x versions before 23.2.18...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

PT-2023-31716 · Redpanda · Redpanda

Name of the Vulnerable Software and Affected Versions: Redpanda versions prior to 23.1.21 Redpanda versions 23.2.x prior to 23.2.18 Description: The issue is related to missing authorization checks in the "Transactions API". This could potentially allow unauthorized access or actions...

CVE-2023-50976

CVE-2023-50976 affects Redpanda before 23.1.21 and 23.2.x before 23.2.18. The issue is missing authorization checks in the Transactions API, as stated by multiple sources (Redpanda/Redpanda PRs and security portals). Impact is implied as high due to authorization gaps, but the connected documents...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

CVE-2023-30450

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpcservertls field, leading to for example situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure while a cluster is turned off in order to have TLS on broker RPC ports...

Code injection

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpcservertls field, leading to for example situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure while a cluster is turned off in order to have TLS on broker RPC ports...