CVE-2026-19274

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19283

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19283 IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

CVE-2026-19274: Improper Access Control

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR na...

CVE-2026-19283: Incorrect Authorization

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...

GO-2024-3311 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, prometheus, promxy, vault, pulumi, amazon-cloudwatch-agent-operator, promxy-fips...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: cloudnative-pg, cilium-cli, temporal, terraform-docs, zarf, sigstore-scaffolding, kwok, grafana-agent-operator, sops, rqlite, opentelemetry-collector, vcluster, dbmate, tflint, terragrunt, k3d, hubble-ui, zot, k8sgpt, osv-scanner, gomplate, pulumi-language-dotnet,...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: prometheus-operator, metrics-server, tempo, karma, loki, grafana, istio, prometheus, jaeger, k8sgpt, fluent-bit-plugin-loki, node-problem-detector, minio, mc, splunk-otel-collector, certificate-transparency, prometheus-pushgateway, amazon-cloudwatch-agent-operator,...

GO-2024-3311 vulnerabilities

Vulnerabilities for packages: pulumi, promxy, amazon-cloudwatch-agent-operator...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: promxy, kubevela, k3s, pulumi, rancher-agent, amazon-cloudwatch-agent-operator...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rekor, thanos, prometheus-operator, tkn, wal-g, pulumi, goreleaser, druid, zarf, flux-source-controller, boring-registry, cortex, sigstore-scaffolding, argo-workflows, bank-vaults, grafana-agent-operator, hugo, sops, flux, rclone, trino, terragrunt, buildkitd,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cerbos, grafana-rollout-operator, nri-rabbitmq, cni-plugins, azure-service-operator, kubernetes-dashboard-api, ko, kapp-controller, rabbitmq-messaging-topology-operator, grafana-alloy, rclone, ini-file, harbor-cli, zot, aws-eks-pod-identity-agent, docker-cli-buildx,...

CLEANSTART-2026-HN48536 Security fixes in grafana-agent-operator 0.44.3-r1

Package grafana-agent-operator version 0.44.3-r1 fixes 6 vulnerabilities: CVE-2026-39828, ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv, ghsa-x527-x647-q7gg...

CLEANSTART-2026-MO12071 Security fixes in grafana-agent-operator 0.44.8-r0

Package grafana-agent-operator version 0.44.8-r0 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: cadence-fips, amazon-cloudwatch-agent, cerbos, flux-image-automation-controller, apply-cve-bump, kubernetes-dns-node-cache, yunikorn-k8shim, crossplane-provider-gitlab-fips, cert-manager-cmctl-fips, weaviate, seaweedfs-rocksdb-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: cadence-fips, flux-image-automation-controller, yunikorn-k8shim, crossplane-provider-gitlab-fips, cert-manager-cmctl-fips, crossplane-provider-azure-streamanalytics, aws-efs-csi-driver-fips, flux, kubernetes-csi-external-snapshotter, crossplane-provider-aws-ec2,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, skopeo, tetragon, ko, flux-helm-controller, haproxy-ingress, rclone, gitlab-runner, step-issuer, envoy-ratelimit, cilium, external-dns, hubble, crossplane-provider-azure-storage, argo-rollouts, crossplane-provider-aws-lambda, spark-operator...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: cerbos, grafana-rollout-operator, sftpgo-plugin-eventsearch, crossplane-provider-keycloak, ingress-nginx-controller, cadvisor, kubernetes-csi-external-resizer, terraform-provider-random, kubernetes-event-exporter, task, memcached-exporter, kube-arangodb,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: apko, cadence-fips, cilium-envoy-fips, rabbitmq-default-user-credential-updater, cerbos, flux-image-automation-controller, s5cmd-fips, oauth2-proxy-fips, nri-mysql, crossplane-provider-gitlab-fips, chronyexporter, cert-manager-cmctl-fips,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: cilium-envoy-fips, cerbos, flux-image-automation-controller, kubernetes-dns-node-cache, oauth2-proxy-fips, crossplane-provider-gitlab-fips, chronyexporter, cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, yunikorn-k8shim, authservice, flux,...