EUVD-2026-63474

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

PT-2026-79061

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

EUVD-2026-59772

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

CVE-2026-19898

CVE-2026-19898 affects VictoriaMetrics up to version 1.146.0, specifically the VMAuth Authentication Endpoint (file app/vmauth/main.go, function requestHandler). A manipulation can lead to improper restriction of excessive authentication attempts, with remote attack possibility. The exploit is de...

CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...

GO-2025-4161 vulnerabilities

Vulnerabilities for packages: victoriametrics-operator-fips, victorialogs-fips, victorialogs...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: terragrunt, victoriametrics-fips, gotenberg, metacontroller, victoriametrics-cluster-fips, flux-source-watcher, flux-operator-fips, flux-helm-controller, grafana-rollout-operator, dkron, amazon-k8s-cni-fips, loki-fips, omnictl-multiarch, victorialogs, pgwatch,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: go, steampipe, grafana-rollout-operator, metacontroller, flux-notification-controller, victoriametrics-cluster, flux-image-automation-controller, grafana-operator, nova, stakater-reloader, terragrunt, polaris, flux-image-reflector-controller, podinfo, pluto,...

GO-2026-4599 vulnerabilities

Vulnerabilities for packages: go, steampipe, grafana-rollout-operator, metacontroller, flux-notification-controller, victoriametrics-cluster, flux-image-automation-controller, grafana-operator, nova, stakater-reloader, terragrunt, polaris, flux-image-reflector-controller, podinfo, pluto,...

GO-2026-4866 vulnerabilities

Vulnerabilities for packages: go, sftpgo-plugin-eventsearch, grafana-rollout-operator, metacontroller, actions-runner-controller, flux-notification-controller, hubble, victoriametrics-cluster, oras, flux-image-automation-controller, grafana-operator, dgraph, nova, malcontent,...

CLEANSTART-2026-CZ42284 Security fixes in victoriametrics-operator 0.72.0-r1

Package victoriametrics-operator version 0.72.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-FV97418 Security fixes in victoriametrics-operator 0.71.0-r2

Package victoriametrics-operator version 0.71.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-ER59632 Security fixes in victoriametrics-operator 0.71.0-r1

Package victoriametrics-operator version 0.71.0-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-HS77703 Security fixes in victoriametrics-operator 0.72.0-r2

Package victoriametrics-operator version 0.72.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-QM89803 Security fixes in victoriametrics-operator-fips 0.65.0-r1

Package victoriametrics-operator-fips version 0.65.0-r1 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-FL92445 Security fixes in victoriametrics-cluster 1.132.0-r0

Package victoriametrics-cluster version 1.132.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-JD71154 Security fixes in victoriametrics-operator-fips 0.65.0-r2

Package victoriametrics-operator-fips version 0.65.0-r2 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, ghsa-9h8m-3fm2-qjrq, CVE-2026-27139...

CLEANSTART-2026-PH84276 Security fixes for CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42504, CVE-2026-42507 applied in versions: 1.138.0-r0

Multiple security vulnerabilities affect the victoriametrics-vmauth package. These issues are resolved in later releases. See references for individual vulnerability details...