CVE-2026-43867

The Apache Camel PQC Component is vulnerable to deserialization of untrusted data in the AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() method. The root cause is the use of a raw java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allow-list to process Base64-...

CVE-2026-43867 Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

CVE-2026-46456

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

CVE-2026-46456 Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

CVE-2026-43867: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata reads that metadata back from the...

SUSE CVE-2026-13769

Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain CLI subcommands...

CVE-2026-54430

A flaw was found in liboauth2 in the oauth2josejwksawsalbresolve function. The AWS ALB JWT verifier reads the signer and kid fields from the unverified JWT header. When signer matches the configured ARN, kid is appended to the ALB base URL without path sanitization, and an HTTP GET request is...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, kube-arangodb, helm-set-status, kargo, conftest, k8ssandra-client-fips, zarf, zarf-fips, rancher-agent, headlamp, gitlab-operator-fips, gatekeeper, kubescape-server, k9s-fips, oras, rancher-helm, jfrog-cli, cert-manager-cmctl, linkerd2, gogatekeeper...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, kube-arangodb, helm-set-status, kargo, conftest, k8ssandra-client-fips, zarf, zarf-fips, rancher-agent, headlamp, gitlab-operator-fips, gatekeeper, kubescape-server, k9s-fips, oras, rancher-helm, jfrog-cli, cert-manager-cmctl, linkerd2, gogatekeeper...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, kube-arangodb, helm-set-status, kargo, conftest, k8ssandra-client-fips, zarf, zarf-fips, rancher-agent, headlamp, gitlab-operator-fips, gatekeeper, kubescape-server, k9s-fips, oras, rancher-helm, jfrog-cli, cert-manager-cmctl, linkerd2, gogatekeeper...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, kube-arangodb, helm-set-status, kargo, conftest, k8ssandra-client-fips, zarf, zarf-fips, rancher-agent, headlamp, gitlab-operator-fips, gatekeeper, kubescape-server, k9s-fips, oras, rancher-helm, jfrog-cli, cert-manager-cmctl, linkerd2, gogatekeeper...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, opentofu, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, opentofu, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd, kots,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, opentofu, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd, kots,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, opentofu, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: xeol, cilium-cli, headlamp, opentofu, argocd-image-updater, tigera-operator, trivy, kargo, gogatekeeper, gitness, linkerd2, steampipe, teleport, tw, trivy-operator, oras, gatekeeper, helm-push, rancher-agent, maru, helm-set-status, helm-operator, zarf, helm, argo-cd,...

AZL-91679 CVE-2026-54430 affecting package liboauth 1.0.3-15

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...

CVE-2026-54430

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2josejwksawsalbresolve function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to albbaseurl without URL encoding or path sanitization, and the HTT...