CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

MAL-2026-10927 Malicious code in roles-royce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...

CVE-2026-44181

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment variables KERNELXXX used during the rendering of the Kubernetes manifest are vulnerable ...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...

Grafana MCP server-side request forgery via X-Grafana-URL header

A vulnerability has been discovered in the mcp-grafana project https://github.com/grafana/mcp-grafana where a confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request...

CVE-2026-47701

A flaw was found in OpenTelemetry Operator for Kubernetes. A tenant with permissions to create or update a ServiceMonitor resource can configure the bearerTokenFile field to point to the Collector's service account token path. This causes the Collector to send its mounted service account JSON Web...

GO-2026-5850 Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container in github.com/fission/fission...

CVE-2026-11769

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...

EUVD-2026-36101

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container...

Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Summary Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. Details The user controls the builder...

GHSA-8WCJ-MFRC-JX5Q Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container

Summary Fission builder pods were created with ServiceAccountName: fission-builder and no AutomountServiceAccountToken: false, so the kubelet auto-mounted the service-account token into every container in the pod — including the user-supplied builder image. Details The user controls the builder...

CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computatio...

GO-2026-5351 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno

Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno...

Malicious code in react-campaign-optimizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a040ca9a32fe68e08906bdc58b7ae907b8f8092acd9764266de15004b3922e9f On npm install, the package runs node postinstall.js declared in package.json scripts.postinstall which performs unauthenticated, unconsented...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

CVE-2026-11769 Operator - Namespaced User Path Traversal

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...