CVE-2026-100705: Server-Side Request Forgery (SSRF)

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

BIT-KYVERNO-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

PT-2026-98993

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84708

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

CVE-2026-79767

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Grou...

PT-2026-97041

Name of the Vulnerable Software and Affected Versions Gardener versions prior to 1.142.6 Gardener versions prior to 1.143.3 Gardener versions prior to 1.144.2 Gardener versions prior to 1.145.0 Description The customverbauthorizer admission plugin in the Gardener API server contains a flaw in its...

CVE-2026-55226

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

EUVD-2026-78880

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-55226 Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-55226

CVE-2026-55226 is a least-privilege violation in Strimzi (the Apache Kafka operator for Kubernetes/OpenShift), affecting versions 1.0.0 and earlier . When only the Topic Operator or only the User Operator is deployed via the Kafka custom resource, the Entity Operator ServiceAccount retains RBAC p...

CVE-2026-61549

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backendoptions.go defines backendoptions.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without...

CVE-2026-61549: Improper Privilege Management

Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backendoptions.go defines backendoptions.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without...

CVE-2026-55226: Improper Privilege Management

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC...

CVE-2026-84195

A flaw was found in Kyverno, a policy engine for Kubernetes. This vulnerability allows attackers with low privileges to exfiltrate the admission controller's ServiceAccount token. By directing apiCall requests to external or attacker-controlled endpoints, the token is automatically attached witho...

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

CVE-2026-77968 Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

EUVD-2026-72692

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: create, get, list, update, watch across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in th...

Important: Red Hat Security Advisory: Red Hat Multiarch Tuning 1.3.4

The 1.3.4 release of the Red Hat Multiarch Tuning Operator. For more details, see product documentation in the references section. Enhancements: With this update, MTO has been updated to use go version 1.26.7. Bug Fixes: Previously, deleting a ClusterPodPlacementConfig object immediately after...