GO-2024-2918 vulnerabilities

Vulnerabilities for packages: k8sgpt, policy-controller, pulumi, guac, ksops, step-ca, bank-vaults, flyte, wal-g, py3-cassandra-medusa, druid, boring-registry, trivy, opentelemetry-collector, rook, velero, airflow, grafana-mimir, harbor-registry, tkn, fluent-bit-plugin-loki, rekor, zot, sops,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: glow, k8sgateway, cloud-provider-vsphere, conftest, nri-rabbitmq, step-kms-plugin, aactl, azure-service-operator, chartmuseum, controller-gen, kube-logging-operator, kind, portieris, kubernetes-dashboard-api, swagger, nri-redis, spire-controller-manager, zot, gobump,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: pulumi, step-kms-plugin, aactl, argo-cd, external-secrets-operator, zot, vault-benchmark, flux-source-controller, cosign, gh, slsa-verifier, gomplate, flux-image-automation-controller, podman, cluster-api-azure-controller, docker, caddy, flux-notification-controller,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: pulumi, aactl, terraform-provider-pagerduty, argo-cd, rancher-fleet, crossplane-provider-aws-cloudformation, crossplane-provider-aws-firehose, crossplane-provider-aws-sqs, lazygit, zot, crossplane-provider-family-aws, flux-source-controller, gomplate, argo-workflows,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: pulumi, aactl, terraform-provider-pagerduty, argo-cd, rancher-fleet, crossplane-provider-aws-cloudformation, crossplane-provider-aws-firehose, crossplane-provider-aws-sqs, lazygit, zot, crossplane-provider-family-aws, flux-source-controller, gomplate, argo-workflows,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, crossplane-provider-family-aws-fips, crossplane-provider-aws-s3-fips, argo-events, grafana-alloy, helm-diff-fips, crossplane-provider-family-aws, amazon-ssm-agent-fips, vault, kubescape-server, crossplane-provider-aws-lambda, hydra, scorecard,...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G 代码问题漏洞

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...

CVE-2021-38599: Improper Check for Unusual or Exceptional Conditions

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...