CVE-2026-115539

SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a...

CVE-2026-115539

SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a...

CVE-2026-115539

SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a...

CVE-2026-115539

The SwarmKit Cluster-API proxy is vulnerable to a privilege escalation flaw when built with grpc-go 1.39 or later . The WithMetadataForwardTLSInfo function incorrectly replaces outgoing metadata with a copy of incoming metadata, discarding redirect guard changes. During a brief window following a...

PT-2026-144600

Name of the Vulnerable Software and Affected Versions SwarmKit versions prior to 2.1.3 Description The Cluster-API proxy can overwrite a forwarded client's TLS identity with the identity of an intermediary manager. This occurs because the WithMetadataForwardTLSInfo function replaces outgoing...

CVE-2026-103002

A flaw was found in GPUStack. An authenticated remote user without administrator privileges can forward requests through the cluster API server proxy to a connected Kubernetes cluster without proper resource-level authorization checks. Because the proxy executes requests using the credentials of ...

CVE-2026-94448 vulnerabilities

Vulnerabilities for packages: fortio-fips, policy-bot-fips, omni-fips, prometheus-alertmanager, crossplane-provider-aws-sns, external-secrets-fips, beats-fips, prometheus-process-exporter-fips, pgtimetable, blob-csi, karpenter-fips, k8sgateway, contour-fips, kserve-modelmesh-serving, istio,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: policy-bot-fips, cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, zabbix-agent2-fips, grafana-mssql-datasource, spicedb-operator, plugin-barman-cloud, promxy-fips, keda-fips, crossplane-function-kcl-fips, sealed-secrets-fips,...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: kube-arangodb, helm-push, kyverno-notation-aws, manifest-tool, gitness, flux-helm-controller, kargo, rancher-helm, k9s, xeol, opentofu, helm-mapkubeapis, maru, cluster-api-helm-controller, helm-set-status, cert-manager-cmctl, k8sgpt...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: kube-arangodb, helm-push, kyverno-notation-aws, manifest-tool, gitness, flux-helm-controller, kargo, rancher-helm, k9s, xeol, opentofu, helm-mapkubeapis, maru, cluster-api-helm-controller, helm-set-status, cert-manager-cmctl, k8sgpt...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: kube-arangodb, neuvector-scanner, eksctl, docker, docker-cli-buildx, k9s, fuse-overlayfs-snapshotter, buildkitd, kubescape-operator, spegel, syft, k8sgpt, dagger, rancher-agent, trivy-operator, scorecard, k3s, manifest-tool, steampipe, kargo, trivy, kubescape,...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, grafana-mssql-datasource, spicedb-operator, promxy-fips, keda-fips, crossplane-provider-aws-lambda, grafana-fips, azure-service-operator-fips, crossplane-provider-aws-configservice,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: cosign, beats-fips, crossplane-provider-aws-guardduty, k8sgateway, scorecard, grafana-mssql-datasource, spicedb-operator, promxy-fips, keda-fips, crossplane-provider-aws-lambda, grafana-fips, azure-service-operator-fips, crossplane-provider-aws-configservice,...