61 matches found
SUSE CVE-2026-61625
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
CLEANSTART-2026-PP41562 Security fix for CVE-2026-61625 applied in: victoriametrics-operator 0.71.0-r3
Security vulnerability affects the victoriametrics-operator package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101390
Security vulnerability affects the victoriametrics-operator package. This issue is resolved in later releases. See references for vulnerability details...
GO-2026-6366 Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics...
CLEANSTART-2026-GQ91083 Previously, a channel registered in the mux's chanList is not usable until it is established
Multiple security vulnerabilities affect the victoriametrics-operator-fips package. Previously, a channel registered in the mux's chanList is not usable until it is established. See references for individual vulnerability details...
GHSA-8Q3C-RJR9-XXRP VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...
EUVD-2026-63474
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root...
CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
PT-2026-79061
Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...
CVE-2026-61625: Improper Limitation of a Pathname to a Restricted Directory
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
CVE-2026-19898
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898
CVE-2026-19898 affects VictoriaMetrics up to version 1.146.0, specifically the VMAuth Authentication Endpoint (file app/vmauth/main.go, function requestHandler). A manipulation can lead to improper restriction of excessive authentication attempts, with remote attack possibility. The exploit is de...
EUVD-2026-59772
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
CVE-2026-19898: Improper Restriction of Excessive Authentication Attempts
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
GO-2025-4161 vulnerabilities
Vulnerabilities for packages: victoriametrics-operator-fips, victorialogs-fips, victorialogs...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: flux-operator-fips, flux-source-watcher, flux-source-controller, flux-notification-controller, victoriametrics-cluster-fips, dkron, victorialogs, librechat, steampipe, localstack, metacontroller, nova-fips, aws-ebs-csi-driver-fips, podinfo, terragrunt,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: stakater-reloader, steampipe, grafana-operator, nova, go, victoriametrics, dkron, grafana-rollout-operator, victoriametrics-cluster, metacontroller, flux-notification-controller, flux-source-controller, flux-image-automation-controller, terragrunt, pluto, polaris,...