polaris

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

CVE-2025-1974

🚨 Тест внедрения логов через Admission Controller Ingress-NGINX 🧠 Обзор Этот скрипт проверяет уязвимости внедрения аннотаций в кластерах Kubernetes с помощью контроллера NGINX Ingress. Он предназначен только для целей обнаружения в связи с CVE-2025-1974, которая позволяет вредоносным аннотациям...

CVE-2025-1974

Kubernetes Ingress-NGINX 認証されていないリモートコード実行 CVE-2025-1974 Ingress-NGINX: NGINXをリバースプロキシおよびロードバランサーとして使用するKubernetes用のIngressコントローラー 「IngressNightmare」脆弱性 CVE-2025-1974 は、着信するIngressリソースの有効性を検証するKubernetesの核心的なセキュリティメカニズムであるIngress-NGINX Admission Controllerの致命的な欠陥に起因する。...

CVE-2025-1974

CVE-2025-1974 화이트햇 스쿨 3기 - 김소은 @salt318 https://github.com/salt318/vulhub 요약 쿠버네티스의 핵심 보안 메커니즘인 Ingress-NGINX Admission Controller의 결함으로 인해 발생 Ingress-NGINX Admission Controller는 인증 없이 네트워크에 노출됨 이로 인해 공격자가 악성 AdmissionReview 요청을 조작하여 Ingress 리소스에 무단 구성을 삽입할 수 있음 다른 취약점과 연계될 겨여우 원격 코드 실행 가능...

IngressNightmare-PoC

Ingress NGINX 취약점 익스플로잇 - IngressNightmare 이 프로젝트는 Kubernetes의 Ingress NGINX Controller에서 발견된 인증되지 않은 원격 코드 실행RCE 취약점을 대상으로 하는 익스플로잇을 제공하며, 이 취약점들은 IngressNightmare로 통칭됩니다. 연구: Wiz 원본 연구에서 Wiz 팀은 PoC나 실제 익스플로잇을 제공하지 않았기 때문에, 우리는 자체적으로 제작하여 커뮤니티와 공유하기로 결정했습니다. 개요 Ingress NGINX Controller는 Kubernet...

IngressNightmare-RCE-POC

⚠️ Critical RCE in Ingress-NGINX via Configuration Injection CVE-2025-1974 and more 이 저장소는 Kubernetes용 Ingress-NGINX 컨트롤러의 CVE-2025-1974 CVSS 9.8, 중요Critical 취약점에 대한 개념 증명PoC 익스플로잇을 포함합니다. 이 결함은 Validating Admission Controller를 사용할 때 안전하지 않은 설정 주입을 통해 인증되지 않은 원격 코드 실행을 허용합니다. 이는 2025년 3월 26일에 공개 및...

trivy-enforcer

trivy-enforcer 実験的 イメージ保証のためのKubernetes Operator 以下のように動作します: Admission Controller 安全でないイメージがデプロイされるのを防ぎます Custom Controller ImageVulnerability CRDを監視し、カスタムリソース内のイメージを自動的にスキャンします セットアップ root@kitploit: $ kubectl apply -f manifests/opa.yaml $ kubectl apply -f manifests/cert-manager.yaml $ export...

CVE-2026-5556-Kubernetes-Admission-Controller-Bypass-via-Case-Sensitivity

CVE-2026-5556 – Kubernetes アドミッションコントローラーの大文字小文字の区別によるバイパス プログラムコード（Python アドミッションウェブフック＋エクスプロイト） root@kitploit: !/usr/bin/env python3 admissionwebhook.py - Vulnerable webhook that rejects pods with specific name from flask import Flask, request, jsonify app = Flaskname DENIEDPODNAMES =...

CVE-2025-1974

cve-2025-1974-win11-attack-defense-lab Первый на Windows 11 образовательный репозиторий для изучения CVE-2025-1974 в безопасной, невооруженной лаборатории ATTACK + DEFENSE. Проект предназначен для университетских курсов, командных демонстраций и создания скриншотов, готовых для отчетов. Он...

CVE-2025-1974

ДЕМО https://youtu.be/3hYlHeaf2mQ Что такое CVE-2025-1974? CVE-2025-1974 IngressNightmare — это критическая CVSS 9.8 уязвимость удалённого выполнения кода без аутентификации в admission controller'е Kubernetes ingress-nginx. Схема атаки: 1. Загрузка : Отправка вредоносной разделяемой библиотеки ....

CVE-2026-54523

A flaw was found in Kyverno, a policy engine for cloud-native platforms. A user with specific permissions to create policy objects in one area namespace can exploit a vulnerability where a namespace argument is not properly checked. This allows them to force the system's admission controller, whi...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

PT-2026-84158

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

GO-2026-5268 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

CVE-2026-10609

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrat...

CVE-2026-41323

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...

Authorization Bypass

Kyverno is vulnerable to Authorization Bypass. The vulnerability is due to a critical authorization boundary bypass in namespaced Kyverno Policy apiCall, where the resolved urlPath is executed using the Kyverno admission controller ServiceAccount, with no enforcement that the request is limited t...

BIT-KYVERNO-2026-41485 Kyverno Controller Denial of Service via forEach Mutation Panic

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...