GO-2025-3922 vulnerabilities

Vulnerabilities for packages: conftest-fips, packer-fips, tflint, trivy, grafana-alloy-fips, drone, terraform, regclient-fips, filebrowser, k8s-image-swapper-fips, k8s-image-swapper, k9s, atlantis-fips, trufflehog, packer, xeol, envoy-gateway, grafana-alloy, zot, mattermost-fips,...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: amazon-ecs-agent-fips, rke2-runtime, kubevirt-cdi-uploadserver, prometheus, amazon-cloudwatch-agent-operator, amazon-ecs-agent, kubevela, pulumi, amazon-cloudwatch-agent-operator-fips, k3s, vault, promxy, rancher-agent, harvester, rancher, harvester-fips...

GO-2024-3311 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator, pulumi, amazon-cloudwatch-agent-operator-fips, vault, promxy, promxy-fips, prometheus...

GO-2026-5004 vulnerabilities

Vulnerabilities for packages: dapr-fips, hydra-fips, grafana-alloy-fips, argo-workflows, falcosidekick, bento, step-issuer-fips, spire-server-fips, azure-service-operator, commercial-chainloop-backend, envoy-gateway, grafana-alloy, juicefs, authentik, spicedb-fips, gitness,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: argo-events, dapr-fips, splunk-otel-collector, bento, amazon-cloudwatch-agent-fips, grafana-alloy, splunk-otel-collector-fips, vault, cluster-api-aws-controller-fips, sqlexporter, cluster-api-aws-controller, jitsucom-bulker, argo-events-fips, amazon-cloudwatch-agent,...

GO-2026-5764 vulnerabilities

Vulnerabilities for packages: conftest-fips, trivy, dapr-fips, grafana-alloy-fips, amazon-ecs-agent, pulumi, chainloop-cli-fips, crossplane-provider-aws-sns-fips, wolfictl, falcosidekick, k9s, aws-s3-controller, bento, spire-server-fips, amazon-cloudwatch-agent-fips, clickhouse-backup-fips,...

GO-2025-4175 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-attacher-fips, rancher-loglevel, kiali, mongo-tools, ytt-fips, amazon-cloudwatch-agent-fips, ratify-fips, spicedb-fips, helm-diff-fips, cluster-api-gcp-controller-fips, rke2-cloud-provider-fips, kiali-fips, spiffe-helper-fips, trillian-fips,...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: net-kourier, kube-state-metrics, k8s-device-plugin, terraform-provider-tls, syft, secrets-store-csi-driver-provider-gcp, secrets-store-csi-driver-provider-azure, buildah, kubevela, fscrypt, kubescape, crossplane-provider-aws-dynamodb, docker-cli, sqlexporter,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: net-kourier, spark-operator, kube-state-metrics, crossplane-provider-azure-authorization, knative-serving, rancher-fleet, docker-machine-driver-harvester, jitsucom-bulker, buildah, kubevela, kubescape, kubernetes-replicator, crossplane-provider-aws-dynamodb,...

GO-2026-5037 vulnerabilities

Vulnerabilities for packages: net-kourier, spark-operator, kube-state-metrics, crossplane-provider-azure-authorization, knative-serving, rancher-fleet, docker-machine-driver-harvester, jitsucom-bulker, buildah, kubevela, kubescape, kubernetes-replicator, crossplane-provider-aws-dynamodb,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: knative-serving, tw, buildah, sqlexporter, etcd, kubescape-operator, kots, bento, terraform-docs, rancher-machine, argo-workflows, crossplane-provider-aws-route53, aactl, cluster-api-azure-controller, pulumi, steampipe, distribution, flux,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, terraform-provider-tls, knative-serving, syft, tw, buildah, openbao, fscrypt, grype, kubescape, crossplane-provider-aws-dynamodb, cloudflared, gitlab-runner, cosign, kots, crossplane-provider-aws-elasticache, external-dns,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: spark-operator, git-sync, cloud-provider-vsphere, esbuild, calico, thanos-operator, kubernetes-replicator, ratify, crossplane-provider-aws-dynamodb, vault-secrets-webhook, runc, kubescape-operator, hubble-ui, gitlab-runner, cosign, kube-vip-cloud-provider,...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715

CVE-2026-8715 – Vault Secrets Operator : Affected versions are 1.3.0–1.4.1 of Vault Secrets Operator. The issue is an arbitrary file read/credential exfiltration in the AppRole authentication configuration that could allow a tenant with limited Kubernetes RBAC to read files from the operator pod ...

CVE-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

EUVD-2026-58400

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...