GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: sops, kubo, bank-vaults, knative-operator, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, amass, rancher-system-upgrade-controller, nova, kubernetes-dashboard, cluster-api-gcp-controller, langfuse, influx, crossplane-provider-aws-ec2, nats-top,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: sops, kubo, bank-vaults, knative-operator, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, amass, rancher-system-upgrade-controller, nova, kubernetes-dashboard, cluster-api-gcp-controller, langfuse, influx, crossplane-provider-aws-ec2, nats-top,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: sops, kubo, bank-vaults, knative-operator, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, amass, rancher-system-upgrade-controller, nova, kubernetes-dashboard, cluster-api-gcp-controller, langfuse, influx, crossplane-provider-aws-ec2, nats-top,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kong-ingress-controller-fips, crossplane-provider-aws-kinesis-fips, undock, temporal-server-fips, timoni, redpanda, fleet-server, kserve-rest-proxy, cluster-api-azure-controller, langfuse-fips, step-kms-plugin, elastic-agent-fips, crossplane-fips,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: kong-ingress-controller-fips, crossplane-provider-aws-kinesis-fips, syncthing, undock, sealed-secrets, temporal-server-fips, timoni, redpanda, fleet-server, kserve-rest-proxy, cluster-api-azure-controller, kaniko-fips, langfuse-fips, step-kms-plugin,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: nrdot-collector-k8s, sealed-secrets, fleet-server, kserve-rest-proxy, langfuse-fips, crossplane-fips, docker-credential-gcr-fips, aws-flb-cloudwatch-fips, go-fips, sops, juicefs, azuredisk-csi-fips, kube-metrics-adapter-fips, opentelemetry-operator, flannel-cni-plugi...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via resource exhaustion caused by improper cleanup of long-lived resources. Several components fail to correctly close or release gRPC connections, SPIFFE sources, and streaming...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via resource exhaustion caused by improper cleanup of long-lived resources. Several components fail to correctly close or release gRPC connections, SPIFFE sources, and streaming...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via resource exhaustion caused by improper cleanup of long-lived resources. Several components fail to correctly close or release gRPC connections, SPIFFE sources, and streaming...

Zero Trust Security Model Implementation in Microservices Architectures Using Identity Federation

The microservice bombshells that have been linked with the microservice expansion have altered the application architectures, offered agility and scalability in terms of complexity in security trade-offs. Feeble legacy-based perimeter-based policies are unable to offer safeguard to distributed...

EUVD-2021-1097

Malware in sbrugna...

EUVD-2021-13869

Malware in sbrugna...

CVE-2021-27098

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

CVE-2021-27099

In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "awsiid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of ...

Decoupling Identity from Access: Credential Broker Patterns for Secure CI/CD

Credential brokers offer a way to separate identity from access in CI/CD systems. This paper shows how verifiable identities issued at runtime, such as those from SPIFFE, can be used with brokers to enable short-lived, policy-driven credentials for pipelines and workloads. We walk through practic...

Establishing Workload Identity for Zero Trust CI/CD: from Secrets to SPIFFE-Based Authentication

CI/CD systems have become privileged automation agents in modern infrastructure, but their identity is still based on secrets or temporary credentials passed between systems. In enterprise environments, these platforms are centralized and shared across teams, often with broad cloud permissions an...

Malicious code in spiffe.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6eb1b449a426da8cb050cd7559c89a205d1bcc3ad27411fc486afe58b7ab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Pipelines do not validate child UIDs

Summary Pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. We should add UID to PipelineRun status and validate that child Run status/results only come from Runs...

Chrono has potential segfault issue in SPIFFE authenticator

Impact Several vulnerabilities have been reported in the time and chrono crates related to handling of calls to localtimer. You can follow some of the discussions here and here, and the associated CVE here. In our case, the issue with the dependency was flagged by our nightly CI build running...

GHSA-45W3-V3G4-54PM Chrono has potential segfault issue in SPIFFE authenticator

Impact Several vulnerabilities have been reported in the time and chrono crates related to handling of calls to localtimer. You can follow some of the discussions here and here, and the associated CVE here. In our case, the issue with the dependency was flagged by our nightly CI build running...