GO-2026-4394 vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, cri-tools, docker, ratify, kubevela, ferretdb, sops, kube-metrics-adapter, envoy-gateway, gomplate, trivy-operator, vault-secrets-webhook, grafana-pyroscope, kaniko, cluster-api-gcp-controller, traefik, docker-compose, kubescape,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: teleport, ratify, cosign, neuvector-sigstore-interface, kyverno-notation-aws, goreleaser, slsa-verifier, trivy-operator, kyverno, witness, zarf, ko, kubescape, policy-controller, zot, falcoctl, tflint, gh, tekton-chains, crossplane, spire-server,...

CVE-2026-18677

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18677

In Kong Mesh (universal mode), the XDS authenticator in kuma-cp validates the dataplane’s SPIFFE ID path template against the kuma.io/workload label only when the dataplane token is bound to a workload. Because workload binding is optional, a dataplane presenting a tags-bound token can register w...

EUVD-2026-57424

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

PT-2026-71208

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...

CVE-2026-65602

A flaw was found in Traefik. A low-privileged Kubernetes user can bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. By setting a forbidden cross-provider reference, Traefik may use a file-provider TCPServersTransport. This can lead to the exposu...

CVE-2026-65602

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...

CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...

PT-2026-63360

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization due to the serviceAccountRegex matcher in pilot/pkg/security/authz/model/generator.go. An attacker can gain access to workloads protected by AuthorizationPolicy rules by presenting a SPIFFE identity whose namespa...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-kyverno-fips, nerdctl, commercial-expanso-edge, trivy-operator, trillian-fips, envconsul-fips, frankenphp-8.4, kaniko-fips, terraform-provider-acme-fips, istio-fips, cg, cert-manager-fips, opentofu-fips, zitadel, grpc-health-probe, sop...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-kyverno-fips, nerdctl, commercial-expanso-edge, trivy-operator, trillian-fips, envconsul-fips, frankenphp-8.4, kaniko-fips, terraform-provider-acme-fips, istio-fips, cg, cert-manager-fips, opentofu-fips, zitadel, grpc-health-probe, sop...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, grafana-rollout-operator, cri-tools, pulumi, aws-load-balancer-controller, tempo, kubevela, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, prometheus-operator, external-dns, kube-metrics-adapter, sops,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, grafana-rollout-operator, cri-tools, pulumi, aws-load-balancer-controller, tempo, kubevela, crossplane-provider-aws-cloudformation, volume-modifier-for-k8s, prometheus-operator, external-dns, kube-metrics-adapter, sops,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, grafana-rollout-operator, pulumi, tempo, newrelic-nri-kube-events, helm-docs, cert-exporter, mattermost, whereabouts, opentelemetry-collector-contrib, metacontroller, neuvector-dbgen, nri-prometheus, vt-cli, redis-operator, docker-cli,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: telegraf, boring-registry, grafana-rollout-operator, pulumi, tempo, newrelic-nri-kube-events, helm-docs, cert-exporter, mattermost, whereabouts, opentelemetry-collector-contrib, metacontroller, neuvector-dbgen, nri-prometheus, vt-cli, redis-operator, docker-cli,...