GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flyte, harbor-registry, rekor, timestamp-authority, bank-vaults, hugo-extended, rclone, opentelemetry-collector, trino, rook, kubescape, hugo, step-ca, goreleaser, grafana-agent-operator, velero, airflow, nuclei, zarf, guac, sqlpad, tkn, chezmoi, step, wal-g,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: harbor-registry, pluto, terraform-provider-azapi, rclone, envconsul, ko, kubernetes-csi-driver-nfs, nri-mysql, ratify, prometheus, azure-service-operator, terraform, headlamp, nuclei, undock, guac, kubeflow-katib, k8sgateway, nginx-prometheus-exporter,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: step-issuer, ko, crossplane-provider-azure-storage, prometheus, nuclei, snyk-cli, guac, buildah, gitlab-kas, nfpm, step, docker-machine-driver-harvester, tekton-chains, go-discover, falcoctl, melange, trivy, witness, zot, cilium, mattermost, vault-benchmark, k8sgpt,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: rclone, ratify, crossplane-provider-azure-storage, goreleaser, crossplane-provider-keycloak, osv-scanner, nuclei, snyk-cli, vcluster, guac, rancher-fleet, nfpm, actions-runner-controller, crossplane, melange, crossplane-provider-aws-sns, gitaly, trivy, witness, zot,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: rclone, ratify, crossplane-provider-azure-storage, goreleaser, crossplane-provider-keycloak, osv-scanner, nuclei, snyk-cli, vcluster, guac, rancher-fleet, nfpm, actions-runner-controller, crossplane, melange, crossplane-provider-aws-sns, gitaly, trivy, witness, zot,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: trufflehog-fips, gitea, nuclei, crossplane-provider-azure-sql, argo-cd, q, argo-cd-fips, argo-workflows-fips, cluster-api-fips, helm, cilium-cli, crossplane-provider-aws-elasticache-fips, crossplane-provider-family-azure, gomplate-fips, cloudbeat, vcluster,...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599: Improper Check for Unusual or Exceptional Conditions

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G code issue vulnerabilities

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...

PT-2021-22237

Name of the Vulnerable Software and Affected Versions WAL-G versions prior to 1.1 Description The issue arises when a non-libsodium build of WAL-G is used, causing it to silently ignore the libsodium encryption key and upload backups in cleartext. This behavior is considered a violation of the...