EUVD-2026-53258

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55996 Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...

CVE-2026-55996 Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...

CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208

KubeSphere CVE-2026-71208 describes SSRF risk in the cluster-controller reconciliation. The addCluster path reads every Cluster CRD’s connection config and calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, using only URL syntax validation (no allow/deny list for...

CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

EUVD-2026-53205

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

PT-2026-68046

Name of the Vulnerable Software and Affected Versions KubeSphere affected versions not specified Description The cluster-controller reconciliation process in the addCluster function located in pkg/utils/clusterclient/clusterclient.go processes connection configurations for Cluster custom resource...

CVE-2026-10090: Privilege Defined With Unsafe Actions

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-55996: Allocation of Resources Without Limits or Throttling

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...

CVE-2026-71208: Server-Side Request Forgery (SSRF)

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

PT-2026-68062

Name of the Vulnerable Software and Affected Versions Rancher affected versions not specified Description A denial-of-service issue exists in multiple TLS listeners within the Rancher server and the cattle-cluster-agent component. These components utilize the dynamiclistener library to handle TLS...

Exploit for CVE-2026-21008

--- CVE-2026-21008 – Kubernetes Service Account Token Mounte...

RHEL 8 : fence-agents (RHSA-2026:49927)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49927 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable...

Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

Virtuozzo Infrastructure 7.4 Hotfix 1 (7.4.0-75)

This update provides stability fixes. Vulnerability id: VSTOR-102068, VSTOR-102069, VSTOR-138302 Creating a VM in a server group could fail with "No valid host found" because a previously canceled or failed VM remained in the server group. Vulnerability id: VSTOR-120923 VPN could stop working whe...

allennlp (>=2.2.1.dev20210408, <=2.7.0), allennlp-dataframe-mapper (0.2.1) +20 more potentially affected by CVE-2026-9856 via transformers (4.5.1)

transformers PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =2.2.1.dev20210408, =2.2.1.dev20210329, =0.0.0.2, =1.37.0, =0.0.1, =0.1.0, =0.3.0b1, =0.0.1, =1.0.23, =1.1.3 - nlp-nn 0.0.11.0...