EUVD-2026-51591

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725

The vault-secrets-webhook Kubernetes mutating webhook is vulnerable prior to version 1.23.1, allowing direct secret injection into Pods via parseVaultConfig() accepting vault-addr annotation and related webhook behavior. The vault-serviceaccount setting can cause a ServiceAccount JWT to be sent t...

EUVD-2026-51295

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests...

CVE-2026-65834

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-65834

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

SUSE CVE-2026-49823

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a Fission Function spec carries three reference types - Secret, ConfigMap, and Package. The first two were namespace-validated by...

SUSE CVE-2026-49824

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Fission Function admission webhook pkg/webhook/function.go validated that spec.secrets.namespace and spec.configmaps.namespace...

PT-2026-66596

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.8 Description The configuration admission webhook fails to validate the CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex variables...

EUVD-2026-36074

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption...

GO-2026-6015 Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper...

Uncontrolled Resource Consumption

github.com/zalando/skipper is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to reading the entire admission webhook request body without enforcing a size limit, which allows an attacker to send excessively large payloads and exhaust memory, resulting in a...

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary The Kubernetes admission webhook handler reads the entire request body using io.ReadAllr.Body without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts a...

GHSA-CWXQ-RC9X-2JVV Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Summary The Kubernetes admission webhook handler reads the entire request body using io.ReadAllr.Body without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts a...

PT-2026-60893

Name of the Vulnerable Software and Affected Versions Skipper affected versions not specified Description The Kubernetes admission webhook handler reads the entire request body without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a...

kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled. The dataplane authentication token is sent over this unverified connection Impact An on-path attacker can intercept the dataplane...

GHSA-QF34-295C-26V8 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

Impact A privilege escalation vulnerability affects Woodpecker instances using the Kubernetes backend. The pipeline option backendoptions.kubernetes.serviceAccountName was passed directly to the pod spec without any admin gating. Who is impacted: any operator running the Kubernetes backend. Any...

PT-2026-60111

Name of the Vulnerable Software and Affected Versions Woodpecker CI versions v1.0.0 through v3.15.0 Description A privilege escalation issue exists in instances using the Kubernetes backend. The pipeline option backend options.kubernetes.serviceAccountName is passed directly to the pod spec witho...

GO-2026-5846 Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook in github.com/fission/fission

Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook in github.com/fission/fission...