CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-79787 Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: flannel, hey, kubernetes-replicator, timoni, whereabouts, kuberlr, paranoia, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe, nri-f5, stakater-reloader, cloud-provider-aws, conjur-cli, secrets-store-csi-driver-provider-aws,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: metrics-server, flannel, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, trivy-operator, ipfs-cluster, rekor, stakater-reloader, kafkaexporter, doppler-kubernetes-operator, mongo-tools, kubernetes-csi-driver-nfs, govulncheck, cue,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, kubernetes-csi-livenessprobe,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: stern, metrics-server, kubernetes-replicator, hey, timoni, whereabouts, cloud-provider-gcp-cloud-controller-manager, custom-pod-autoscaler-operator, skopeo, go-md2man, kuberlr, trivy-operator, ipfs-cluster, docker-machine-driver-linode, rekor, stakater-reloader, kpt,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, telegraf, fulcio, kyverno, pvc-autoresizer-fips, neuvector-dbgen, kube-state-metrics, pgpool2exporter, scanner-test-golang-vulnerability-fixed, mountpoint-s3-csi-driver, multus-cni-fips, fixuid, helm-push, azure-ipam, configmap-reload,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, telegraf, fulcio, kyverno, pvc-autoresizer-fips, neuvector-dbgen, kube-state-metrics, pgpool2exporter, scanner-test-golang-vulnerability-fixed, mountpoint-s3-csi-driver, multus-cni-fips, fixuid, helm-push, azure-ipam, configmap-reload,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, telegraf, fulcio, kyverno, pvc-autoresizer-fips, neuvector-dbgen, kube-state-metrics, pgpool2exporter, scanner-test-golang-vulnerability-fixed, mountpoint-s3-csi-driver, multus-cni-fips, fixuid, helm-push, azure-ipam, configmap-reload,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, telegraf, fulcio, kyverno, pvc-autoresizer-fips, neuvector-dbgen, kube-state-metrics, pgpool2exporter, mountpoint-s3-csi-driver, multus-cni-fips, fixuid, helm-push, azure-ipam, configmap-reload, grafana-pyroscope, jitsucom-bulker, packer,...