CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

EUVD-2026-84568

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384

The Amazon amazon-connect-salesforce-lambda component (versions before 5.26 ) is vulnerable to privilege escalation due to missing authorization in the sfExecuteAWSService function. This allows any IAM principal with lambda:InvokeFunction permissions to perform restricted AWS API operations becau...

CVE-2026-94384 Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

CVE-2026-94384: Missing Authorization

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

PT-2026-96855

Name of the Vulnerable Software and Affected Versions Amazon amazon-connect-salesforce-lambda versions prior to 5.26 Description Missing authorization in the Amazon Connect Salesforce integration allows an IAM principal with lambda:InvokeFunction permission to escalate privileges. The...

CVE-2026-79916

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

CVE-2026-79916

MaxKB is an open-source enterprise AI assistant. Prior to 2.10.5-lts , authenticated workspace members can inject control characters into the AWS Bedrock access_key_id and secret_access_key fields. The _update_aws_credentials function writes these values to /root/.aws/credentials without safe par...

CVE-2026-79916 MaxKB AWS Bedrock model credential injection leads to remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

OPENSUSE-SU-2026:21925-1 Security update for keybase-client

This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-89090: Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder...

CVE-2026-79916: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock accesskeyid and secretaccesskey fields that updateawscredentials writes to /root/.aws/credentials without safe parsing. An attacker can append a...

PT-2026-96146

Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.65.0 Description The .github/workflows/pr integration tests.yml workflow uses pull request target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits. This allows ...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:3992-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3992-1 advisory. - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes bsc1274300. -...

PT-2026-96261

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Authenticated workspace members can inject control characters into the AWS Bedrock access key id and secret access key fields. These values are processed by the update aws credentials function and...

GHSA-V2PF-75PF-9C5H vulnerabilities

Vulnerabilities for packages: linux-raspberry-pi, linux-qemu, linux-raspberry-pi-4, linux-vmware, linux-azure, linux-desktop, linux-qemu-melange, linux-aws, linux-gcp, linux-firecracker...

CLEANSTART-2026-ZG24378 Security fix for CVE-2025-61727 applied in: apache-nifi 2.10.0-r4, aws-flb-firehose 1.7.2-r0, aws-flb-kinesis 1.10.3-r0, calico-fips 3.31.2-r1, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cloudnative-pg-fips 1.24.4-r0, cloudnative-pg-fips 1.25.4-r0, cloudnative-pg-fips 1.26.2-r0, cni-plugin-flannel 1.6.0-r0, cni-plugins-fips 1.8.0-r0, configmap-reload 0.15.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.6-r0, consul-k8s-fips 1.9.1-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, docker-fips 28.4.0-r0, druid-exporter-fips 0.10-r1, druid-exporter-fips 0.11-r2, eck-operator 3.2.0-r1, eks-distro-kube-apiserver-fips 1.34.2-r0, elastic-beats-fips 9.2.2-r0, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r0, external-secrets 0.20.4-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.25 1.25.6-r1, gomplate-fips 4.3.3-r3, harbor-registry 3.0.0.1-r2, harbor-registry-fips 2.6.2-r0, harbor-registry-fips 2.7.1-r0, harbor-registry-fips 2.8.3-r0, harbor-registry-fips 3.0.0-r1, helm-fips 3.17-4-r0, helm-fips 3.19.0-r1, helm-fips 4.0.1-r0, helm-operator-fips 1.39.0-r1, helm-operator-fips 1.41.1-r1, ip-masq-agent 2.12.6-r1, istio-operator-fips 1.25.5-r0, istio-operator-fips 1.26.7-r0, istio-operator-fips 1.27.4-r0, istio-operator-fips 1.28.1-r0, istio-operator-fips 1.4.10-r6, istio-pilot-discovery 1.28.1-r0, istio-pilot-discovery-fips 1.25.5-r0, istio-pilot-discovery-fips 1.26.7-r0, istio-pilot-discovery-fips 1.27.4-r0, istio-pilot-discovery-fips 1.28.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.26.0-r0, k8ssandra-operator-fips 1.27.0-r0, k8ssandra-operator-fips 1.28.0-r0, k8ssandra-operator-fips 1.29.0-r0, kaniko-fips 1.24.0-r0, kapp-controller 0.59.0-r1, kapp-controller-fips 0.59.0-r1, kube-rbac-proxy-fips 0.17.1-r1, kube-rbac-proxy-fips 0.18.2-r2, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-state-metrics-fips 2.17.0-r0, kubernetes 1.31.14-r1, kubernetes 1.32-10-r1, kubernetes 1.33.6-r0, kubernetes 1.34.2-r0, kubernetes-csi-external-resizer-fips 2.0.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-csi-node-driver-registrar-fips 2.15.0-r0, kubernetes-fips 1.31.14-r0, kubernetes-fips 1.32.10-r0, kubernetes-fips 1.32.2-r0, kubernetes-fips 1.33.6-r0, kured 1.20.0-r0, metallb-fips 0.14.9-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.5.2-r1, metrics-server-fips 0.6.4-r1, metrics-server-fips 0.7.2-r3, metrics-server-fips 0.8.0-r5, minio-operator 7.1.1-r3, mongodb 8.2.1-r1, mongodb 8.2.6-r1, multus-cni-fips 4.0.2-r3, multus-cni-fips 4.1.4-r4, multus-cni-fips 4.2.3-r1, nginx-prometheus-exporter 1.5.1-r0, nginx-prometheus-exporter-fips 1.5.1-r0, nvidia-container-toolkit 1.19.0-r0, openbao-fips 2.4.4-r2, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, opentofu-fips 1.10.7-r0, opentofu-fips 1.7.10-r0, opentofu-fips 1.8.11-r0, opentofu-fips 1.9.4-r1, prometheus-fips 3.5.0-r4, prometheus-fips 3.9.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r0, prometheus-node-exporter-fips 1.7.0-r1, prometheus-node-exporter-fips 1.8.2-r1, prometheus-node-exporter-fips 1.9.1-r0, prometheus-operator-fips 0.85.0-r1, prometheus-operator-fips 0.86.2-r0, prometheus-operator-fips 0.87.0-r0, prometheus-redis-exporter-fips 1.77.0-r0, prometheus-redis-exporter-fips 1.78.0-r0, prometheus-redis-exporter-fips 1.79.0-r0, promxy 0.0.93-r1, rabbitmq-messaging-topology-operator 1.15.0-r1, restic 0.18.0-r0, runc 1.1.14-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spire-server-fips 1.13.3-r0, stakater-reloader-fips 1.1.0-r3, stakater-reloader-fips 1.2.1-r1, stakater-reloader-fips 1.3.0-r0, stakater-reloader-fips 1.4.10-r0, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r2, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, terragrunt-fips 0.90.2-r0, terragrunt-fips 0.91.5-r0, terragrunt-fips 0.92.1-r0, terragrunt-fips 0.93.13-r1, thanos-operator-fips 0.3.7-r0, trino 479-r0, velero 1.17.0-r1, velero-fips 1.14.1-r1, velero-fips 1.16.2, vertical-pod-autoscaler 1.5.1-r0, vertical-pod-autoscaler-fips 1.5.1-r0, volume-modifier-for-k8s 0.9.0-r0, volume-modifier-for-k8s-fips 0.9.0-r0, wave-fips 0.10.0-r0, wave-fips 0.9.0-r3

CVE-2025-61727 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ST56458 Security fix for CVE-2025-61728 applied in: apache-nifi 2.10.0-r4, argo-workflows-fips 3.6.16-r0, aws-ebs-csi-driver 1.54.0-r0, aws-eks-pod-identity-agent 0.1.36-r0, aws-eks-pod-identity-agent-fips 0.1.36-r0, aws-flb-cloudwatch 1.9.4-r0, aws-flb-firehose 1.7.2-r0, aws-flb-kinesis 1.10.3-r0, calico-fips 3.31.2-r2, cert-manager 1.19.2-r1, cert-manager-cmctl 2.3.0-r1, cert-manager-cmctl-fips 2.4.0-r2, cert-manager-fips 1.17.4-r1, certificate-transparency-trillian-ctserver 1.3.2-r0, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, cilium 1.18.5-r0, cloudnative-pg-fips 1.24.4-r1, cloudnative-pg-fips 1.25.4-r1, cni-plugin-flannel 1.6.0-r0, cni-plugins 1.9.0-r0, configmap-reload 0.15.0-r0, cortex-fips 1.20.1-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, crossplane-provider-aws 2.3.0-r0, descheduler 0.34.0-r0, druid-exporter-fips 0.10-r2, druid-exporter-fips 0.11-r3, druid-exporter-fips 0.8-r1, druid-exporter-fips 0.9-r1, dynamic-localpv-provisioner 4.4.0-r1, eks-distro-kube-apiserver-fips 1.34.2-r0, envoy-ratelimit 0.0.0_git20251231-r0, external-dns 0.18.0-r0, external-secrets 0.20.4-r0, external-secrets-fips 0.17.0-r2, external-secrets-fips 0.20.4-r2, external-secrets-fips 1.2.0-r0, fluent-operator-fips 3.2.0-r6, fluent-operator-fips 3.3.0-r7, flux-image-automation-controller-fips 4.0.1-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r2, git-sync 4.5.1-r1, gitlab-pages 18.7.1-r0, gitlab-pages-fips 18.7.1-r0, gitness 3.3.0-r1, go-discover-fips 0_git20250325-r1, go-fips-1.25 1.25.5-r0, go1.26 1.25.5-r1, gops 0.3.28-r0, gosu 1.19-r1, harbor-registry-fips 3.0.0.1-r4, helm 4.0.1-r0, helm-operator-fips 1.41.1-r2, hubble-ui 0.13.3-r0, hubble-ui-fips 0.13.3-r0, ip-masq-agent 2.12.6-r1, istio-fips 1.26.8-r0, k8sgpt 0.4.26-r2, k8ssandra-client-fips 0.5.0-r6, k8ssandra-client-fips 0.6.4-r5, k8ssandra-client-fips 0.7.0-r3, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.29.0-r1, kafka_exporter-fips 1.6.0-r0, kafka_exporter-fips 1.7.0-r1, kapp-controller-fips 0.59.0-r2, kserve 0.16.0-r0, kube-bench-fips 0.14.1-r0, kube-state-metrics 2.16.0-r3, kubernetes 1.35.0-r0, kubernetes-csi-external-attacher 4.10.0-r0, kubernetes-csi-external-attacher-fips 4.10.0-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r0, kubernetes-csi-external-resizer 2.0.0-r0, kubernetes-csi-external-snapshotter-fips 8.4.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-dashboard-metrics-scraper 1.2.2-r0, kubernetes-dashboard-metrics-scraper-fips 1.2.2-r0, kubernetes-dashboard-web 1.7.0-r0, kubernetes-ingress-defaultbackend-fips 1.37.5-r0, kubernetes-replicator-fips 2.12.2-r0, kubescape 3.0.47-r0, kured 1.20.0-r0, kyverno-fips 1.13.6-r9, kyverno-fips 1.16.1-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r9, linkerd2 25.12.3-r0, local-static-provisioner 2.8.0-r0, logstash-fips 9.2.4-r2, metallb-fips 0.15.3-r0, minio-operator 7.1.1-r3, minio-operator-fips 5.0.18-r6, minio-operator-fips 6.0.4-r8, minio-operator-fips 7.0.1-r8, minio-operator-fips 7.1.1-r8, newrelic-fluent-bit-output 2.4.0-r0, newrelic-nri-kube-events 2.16.4-r0, nginx-prometheus-exporter 1.5.1-r0, nginx-prometheus-exporter-fips 1.5.1-r1, nri-kubernetes 3.51.2-r0, nvidia-container-toolkit 1.19.0-r0, openbao-fips 2.3.2-r4, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, opentofu-fips 1.7.10-r1, opentofu-fips 1.8.11-r1, percona-xtradb-cluster-operator 1.18.0-r1, percona-xtradb-cluster-operator-fips 1.18.0-r1, prometheus-node-exporter 1.8.0-r3, prometheus-operator 0.87.1-r0, prometheus-redis-exporter-fips 1.77.0-r2, prometheus-redis-exporter-fips 1.78.0-r2, prometheus-redis-exporter-fips 1.79.0-r2, prometheus-redis-exporter-fips 1.80.0-r0, prometheus-redis-exporter-fips 1.80.1-r1, prometheus-statsd-exporter 0.28.0-r0, promxy 0.0.93-r1, rabbitmq-cluster-operator 2.18.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, runc 1.1.14-r0, sealed-secrets 0.33.1-r0, sealed-secrets 0.34.0-r0, sigstore-scaffolding-fips 0.7.31-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.1.1-r3, spark-operator 2.2.1-r0, spark-operator 2.4.0-r0, stakater-reloader-fips 1.2.1-r3, step-issuer 0.9.11-r1, syft 1.39.0-r0, tekton-pipelines 1.5.0-r1, tempo 2.9.0-r0, temporal 1.5.1-r0, terragrunt-fips 0.94.0-r0, terragrunt-fips 0.95.1-r0, timoni 0.25.2-r0, trillian 1.7.2-r0, trino 479-r0, trust-manager-fips 0.21.1-r0, velero 1.17.0-r2, velero-fips 1.17.1-r1, velero-fips 1.17.2-r0, velero-plugin-for-aws 1.10.1-r1, velero-plugin-for-aws 1.12.2-r2, vertical-pod-autoscaler 1.5.1-r1, wave-fips 0.10.0-r1, wave-fips 0.9.0-r3, weaviate 1.35.2-r0, whereabouts 0.9.2-r0, yunikorn-web 1.7.0-r0, zot 2.1.13-r0

CVE-2025-61728 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KK52429 Security fix for CVE-2025-1767 applied in: aws-efs-csi-driver 2.2.0-r1, calico-fips 3.31.2-r1, ip-masq-agent 2.12.6-r1, pulumi-kubernetes-operator 2.7.0-r0

CVE-2025-1767 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...