CLEANSTART-2026-ZB55594 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r2

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r2 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-PP35477 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r1

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r1 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

GO-2023-1793 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rekor, thanos, prometheus-operator, tkn, wal-g, pulumi, goreleaser, druid, zarf, flux-source-controller, boring-registry, cortex, sigstore-scaffolding, argo-workflows, bank-vaults, grafana-agent-operator, hugo, sops, flux, rclone, trino, terragrunt, buildkitd,...

GO-2026-4982 vulnerabilities

Vulnerabilities for packages: kubo, metrics-server, kube-arangodb, minio-object-browser, tempo, goreleaser, sftpgo-plugin-geoipfilter, azure-service-operator, zarf, atlantis, cortex, argo-workflows, skopeo, tetragon, ko, grafana-alloy, lvm-driver, zot, runc, step-issuer, terraform-provider-acme,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, kubo, ctop, git-credential-oauth, ingress-nginx-controller, nri-rabbitmq, kubernetes-csi-external-resizer, kubernetes-event-exporter, govulncheck, minio-object-browser, terraform-docs, goreleaser, sftpgo-plugin-geoipfilter,...

CLEANSTART-2026-OT46541 Security fixes in secrets-store-csi-driver-fips 1.6.0-r1

Package secrets-store-csi-driver-fips version 1.6.0-r1 fixes 5 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-41178, CVE-2026-42505, CVE-2026-39822...

The vulnerability of the secrets-store-csi-driver driver of the Kubernetes cluster management software allows a hacker to gain unauthorized access to protected information.

The vulnerability of the secrets-store-csi-driver driver in the Kubernetes cluster management software is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CLEANSTART-2026-TH78371 Security fixes in secrets-store-csi-driver-fips 1.5.4-r0

Package secrets-store-csi-driver-fips version 1.5.4-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-FP92201 Security fixes in secrets-store-csi-driver-provider-gcp 1.15.0-r1

Package secrets-store-csi-driver-provider-gcp version 1.15.0-r1 fixes 21 vulnerabilities: CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: cerbos, sftpgo-plugin-eventsearch, snyk-cli, kube-arangodb, goreleaser, tailscale, src-fingerprint, cortex, cue, ko, actions-runner-controller, gitness, terragrunt, rootlesskit, kube-logging-operator-custom-runner, neuvector-sigstore-interface,...

CVE-2026-46700

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

CVE-2026-46700: Improper Authorization

Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforces an admin check in OpenID mode. Any...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, github-mcp-server, omnibump, sftpgo-plugin-eventsearch, ingress-nginx-controller, metacontroller, nfs-subdir-external-provisioner, polaris, mariadb-operator, oras, temporal, goreleaser, tailscale, flux-source-controller,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: cerbos, weaviate, kaniko, kubernetes-csi-external-snapshotter, flux-source-controller-fips, loki-fips, cloud-provider-aws, azuredisk-csi, gitlab-runner-fips, cloud-provider-azure-fips, cert-manager-webhook-pdns, dgraph, kapp-controller, tekton-chains,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: cilium-envoy-fips, cerbos, flux-image-automation-controller, sbom-convert, s5cmd-fips, oauth2-proxy-fips, nri-mysql, crossplane-provider-gitlab-fips, chronyexporter, cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, nfs-subdir-external-provisioner-fips,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: cilium-envoy-fips, cerbos, flux-image-automation-controller, sbom-convert, s5cmd-fips, oauth2-proxy-fips, nri-mysql, crossplane-provider-gitlab-fips, chronyexporter, cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, nfs-subdir-external-provisioner-fips,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: cilium-envoy-fips, cerbos, flux-image-automation-controller, s5cmd-fips, oauth2-proxy-fips, nri-mysql, crossplane-provider-gitlab-fips, chronyexporter, cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, nfs-subdir-external-provisioner-fips, authservice, flux,...

Information Disclosure

sigs.k8s.io/secrets-store-sync-controller is vulnerable to Information Disclosure. The vulnerability is due to improper error handling and service account tokens being logged during parameter marshaling errors, and attackers with log access can use these tokens to retrieve secrets from cloud vaul...