Rancher cloud credentials can be used through proxy API by users without access

A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware o...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: gitlab-cng, cerbos-fips, ratify-fips, vault-fips, kubernetes-csi-external-health-monitor, prometheus-mongodb-exporter-fips, cass-operator-fips-no-pvc-delete, descheduler, kyverno-fips, kubernetes-csi-external-provisioner-fips, otel-cli, velero-fips, calico-fips,...

[SECURITY] Fedora 42 Update: rust-afterburn-5.10.0-3.fc42

A simple cloud provider agent...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: rootlesskit, envoy-ratelimit, bazelisk, cluster-proportional-autoscaler, malcontent, certificate-transparency, flux-operator, govulncheck, harbor-scanner-trivy, cilium-certgen, flyte, dapr, cluster-api-aws-controller, manifest-tool, mcp-grafana, cert-manager-istio-cs...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: secretgen-controller, cyberark-secrets-provider-for-k8s, kubernetes-dashboard-web, haproxy-ingress, shfmt, nfpm, flux-image-reflector-controller-fips, ratify-fips, vault-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, kubernetes-csi-external-health-monitor,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: secretgen-controller, cyberark-secrets-provider-for-k8s, kubernetes-dashboard-web, haproxy-ingress, shfmt, nfpm, flux-image-reflector-controller-fips, ratify-fips, vault-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, kubernetes-csi-external-health-monitor,...

[SECURITY] Fedora 43 Update: rust-afterburn-5.10.0-3.fc43

A simple cloud provider agent...

AZL-77010 CVE-2025-58190 affecting package kube-vip-cloud-provider 0.0.10-4

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76889 CVE-2025-58190 affecting package cloud-provider-kubevirt 0.5.1-2

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76886 CVE-2025-47911 affecting package cloud-provider-kubevirt 0.5.1-2

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: opencost, vitess, spqr, mesosphere-vsphere-csi, external-secrets-operator, cloud-provider-azure, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, goreleaser, gatus, nerdctl, govulncheck, redis-operator, secrets-store-csi-driver,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, govulncheck, cluster-api-gcp-controller, dapr, manifest-tool, cert-manager-istio-csr, mockgen, wave, dex, kube-vip-cloud-provider, gitlab-runner, spark-operator, go-md2man, harbor-registry, scorecard, gostatsd, terraform-provider-pagerduty,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: opencost, vitess, spqr, mesosphere-vsphere-csi, external-secrets-operator, cloud-provider-azure, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, goreleaser, gatus, nerdctl, redis-operator, secrets-store-csi-driver, spegel, newrelic-infra-operator,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, govulncheck, cluster-api-gcp-controller, dapr, manifest-tool, cert-manager-istio-csr, mockgen, wave, dex, kube-vip-cloud-provider, gitlab-runner, spark-operator, go-md2man, harbor-registry, scorecard, gostatsd, terraform-provider-pagerduty,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: opencost, vitess, spqr, mesosphere-vsphere-csi, external-secrets-operator, cloud-provider-azure, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, goreleaser, gatus, nerdctl, redis-operator, secrets-store-csi-driver, spegel, newrelic-infra-operator,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, govulncheck, cluster-api-gcp-controller, dapr, manifest-tool, cert-manager-istio-csr, mockgen, wave, dex, kube-vip-cloud-provider, gitlab-runner, spark-operator, go-md2man, harbor-registry, scorecard, gostatsd, terraform-provider-pagerduty,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: secretgen-controller, cyberark-secrets-provider-for-k8s, hubble-ui, cerbos-fips, lazygit, vault-fips, temporal-ui-server-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, net-kourier-fips, prometheus-mongodb-exporter-fips, falco-no-driver, flux-helm-controller-fip...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: secretgen-controller, cyberark-secrets-provider-for-k8s, hubble-ui, cerbos-fips, lazygit, vault-fips, temporal-ui-server-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, net-kourier-fips, prometheus-mongodb-exporter-fips, falco-no-driver, flux-helm-controller-fip...