Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

CVE-2025-2843

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

CVE-2025-2843 Observability-operator: observability operator privilege escalation

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

CVE-2025-2843 Observability-operator: observability operator privilege escalation

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

CVE-2025-2843: Incorrect Privilege Assignment

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with ClusterRole upon deployment of the Namespace-Scoped Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a...

PT-2025-46674

Name of the Vulnerable Software and Affected Versions Observability Operator affected versions not specified Description Incorrect privilege assignment occurs when the operator creates a ServiceAccount with ClusterRole privileges during the deployment of the namespace-scoped Custom Resource...

EUVD-2021-26868

Malware in sbrugna...

EUVD-2025-27707

Malicious code in bioql PyPI...

EUVD-2025-0141

Malicious code in bioql PyPI...

EUVD-2024-1273

Malicious code in bioql PyPI...

EUVD-2025-9524

Malicious code in bioql PyPI...

EUVD-2024-48861

Malicious code in bioql PyPI...

EUVD-2023-2032

Malicious code in bioql PyPI...

SUSE-SU-2025:02423-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - CVE-2021-25743: Escape terminal special characters in kubectl output bsc1194400. - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement bsc1212493. - CVE-2024-0793: Advance autoscaling v2 as the preferred API version...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

CVE-2025-23260 involves NVIDIA AIStore’s AIS Operator. The Red Hat and NVIDIA-NS docs describe an issue where a user can gain elevated access to a Kubernetes cluster by abusing the ServiceAccount bound to the ClusterRole, potentially leading to information disclosure. Affected component is the AI...

NVIDIA AIStore 安全漏洞

NVIDIA AIStore is a lightweight storage stack designed for AI applications from NVIDIA. A security vulnerability exists in NVIDIA AIStore, which stems from the fact that AIS Operator may allow a user to elevate k8s cluster access via ServiceAccount, which could lead to information disclosure...

CVE-2025-23260: Incorrect Privilege Assignment

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...