CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, aws-sigv4-proxy, crossplane-provider-aws-lambda, mc, local-path-provisioner, nats-top, dbmate, ctop, cortex, step, secrets-store-csi-driver-provider-aws, amazon-cloudwatch-agent-operator, helm-set-status, opensearch-k8s-operator, langfuse,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, helm-set-status, kaf, kube-rbac-proxy, mongodb-kubernetes-operator, kube-logging-operator, q, harbor, kubeflow-katib, cert-exporter, aws-node-termination-handler, xeol, timescaledb-parallel-copy, conjur-cli, dataplaneapi,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator, extism,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: mc, aws-sigv4-proxy, local-path-provisioner, mage, dbmate, ctop, cargobump, elvish, helm-set-status, secrets-store-csi-driver-provider-aws, spiffe-helper, opensearch-k8s-operator, wireguard-go, kaf, kube-rbac-proxy, kwok, mongodb-kubernetes-operator,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-kubernetes-fips, nova, cloud-provider-vsphere, pgpool2exporter-fips, policy-controller, sops, portieris, terraform-provider-time, capslock, x509-certificate-exporter-fips, pguser, skopeo, kubernetes-csi-external-attacher-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-kubernetes-fips, nova, cloud-provider-vsphere, pgpool2exporter-fips, policy-controller, sops, portieris, terraform-provider-time, capslock, x509-certificate-exporter-fips, pguser, skopeo, kubernetes-csi-external-attacher-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-kubernetes-fips, nova, cloud-provider-vsphere, pgpool2exporter-fips, policy-controller, sops, portieris, terraform-provider-time, capslock, x509-certificate-exporter-fips, pguser, skopeo, kubernetes-csi-external-attacher-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: fq, terraform-provider-kubernetes-fips, nova, cloud-provider-vsphere, pgpool2exporter-fips, policy-controller, sops, portieris, terraform-provider-time, capslock, x509-certificate-exporter-fips, pguser, skopeo, kubernetes-csi-external-attacher-fips,...