CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: calico, gogatekeeper, golangci-lint, kuma, minio-operator, kserve-modelmesh-serving, flux-notification-controller, lazygit, opensearch-k8s-operator, helm-operator, terraform-provider-pagerduty, podinfo, ip-masq-agent, slsa-verifier, vale, rancher-machine, ytt,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login, helm-set-status,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, cluster-api-provider-vsphere, delve, shfmt, slsa-verifier, task, helm-set-status, spegel, runc, kyverno-policy-reporter-ui, controller-gen, wire-go, dgraph, terraform-provider-kubernetes, boring-registry, azure-workload-identity-webhook,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, docker-credential-ecr-login, helm-set-status,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, xcover, docker-credential-acr-env, cluster-api-provider-vsphere, opensearch-k8s-operator, delve, shfmt, dive, podinfo, ip-masq-agent, slsa-verifier, rancher-machine, task, kwok, sonobuoy, dagdotdev, yunikorn-web, docker-credential-ecr-login,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, onepassword-operator, skaffold, chartmuseum-fips, nerdctl, whereabouts-fips, rancher-loglevel, manifest-tool, src-fingerprint, iptables-wrappers, maru, mongo-tools, mountpoint-s3-csi-driver, velero-plugin-for-microsoft-azure-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, onepassword-operator, skaffold, chartmuseum-fips, nerdctl, whereabouts-fips, rancher-loglevel, manifest-tool, src-fingerprint, iptables-wrappers, maru, mongo-tools, mountpoint-s3-csi-driver, velero-plugin-for-microsoft-azure-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, onepassword-operator, skaffold, chartmuseum-fips, nerdctl, whereabouts-fips, rancher-loglevel, manifest-tool, src-fingerprint, iptables-wrappers, maru, mongo-tools, mountpoint-s3-csi-driver, velero-plugin-for-microsoft-azure-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, onepassword-operator, skaffold, chartmuseum-fips, nerdctl, whereabouts-fips, rancher-loglevel, manifest-tool, src-fingerprint, iptables-wrappers, maru, mongo-tools, mountpoint-s3-csi-driver, velero-plugin-for-microsoft-azure-fips,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache-fips, longhorn-instance-manager, skaffold, aws-otel-collector-fips, apache-exporter, nerdctl, peerdb-flow, authservice, rancher-loglevel, caddy, ksops, mongo-tools, helm, kubernetes-csi-driver-hostpath, falco-exporter-fips,...