Rancher doesn't properly sanitize credentials in cluster template answers

Impact It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens. The exposed credentials are...

GHSA-8W87-58W6-HFV8 Rancher doesn't properly sanitize credentials in cluster template answers

Impact It was discovered that in Rancher versions up to and including 2.5.12 and 2.6.3 there is a failure to properly sanitize credentials in cluster template answers. This failure can lead to plaintext storage and exposure of credentials, passwords and API tokens. The exposed credentials are...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005518)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005518 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our customers reported...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality (CVE-2025-13490)

Summary When an IBM App Connect Enterprise Certified Container IntegrationRuntime or IntegrationServer is configured to report metrics to a Prometheus instance in the OpenShift cluster, the metrics are sent over an unencrypted channel. This bulletin provides patch information to address the...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: node-feature-discovery, spicedb-fips, blob-csi, secrets-store-csi-driver-provider-gcp, kong-ingress-controller, kubernetes-csi-external-health-monitor, prometheus-alertmanager, falcosidekick, cass-operator-fips-no-pvc-delete, temporal, pulumi-kubernetes-operator,...

CVE-2026-22728

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...

GHSA-465P-V42X-3FMJ Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations

This report shows a scope-widening issue in the rotate re-encrypt flow: the output scope can be derived from untrusted spec.template.metadata.annotations on the input sealed secret. If a victim sealed secret is strict- or namespace-scoped, an attacker who can submit it to the rotate endpoint can...

EUVD-2026-8795

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: pulumi, tfsec, cilium-cli, ksops, pulumi-language-java, flux, argocd-image-updater, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, kots, skaffold, pulumi-language-dotnet, crossplane-provider-aws-elasticache, crossplane, crossplane-provider-aws-memoryd...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: pulumi, tfsec, cilium-cli, ksops, pulumi-language-java, flux, argocd-image-updater, crossplane-provider-aws-firehose, crossplane-provider-aws-sns, kots, skaffold, pulumi-language-dotnet, crossplane-provider-aws-elasticache, crossplane, crossplane-provider-aws-memoryd...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, ratify-fips, terraform-fips, apko-fips, docker, omni-fips, crossplane-provider-aws-firehose, gitsign, rancher-fleet-fips, commercial-grafana, terraform, flux-source-controller, crossplane-provider-aws-sns, gitaly-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-azure, ratify-fips, terraform-fips, apko-fips, docker, omni-fips, crossplane-provider-aws-firehose, gitsign, rancher-fleet-fips, commercial-grafana, terraform, flux-source-controller, crossplane-provider-aws-sns, gitaly-fips,...

Important: Red Hat Security Advisory: valkey security update

An update for valkey is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

BIT-SEALED-SECRETS-2026-22728 Bitnami Sealed Secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...

Malformed Valkey Cluster bus message can lead to Remote DoS

...

CVE-2026-22728

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...

[SECURITY] Fedora 42 Update: munge-0.5.18-1.fc42

MUNGE MUNGE Uid 'N' Gid Emporium is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having...

CVE-2026-22728 sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...

CVE-2026-22728 sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation /v1/rotate flow. The rotation handler derives the sealing scope for the newly encrypted output from untrusted spec.template.metadata.annotations present in the input SealedSecret. By submitting a victim...

CVE-2026-22728

CVE-2026-22728 concerns Bitnami Sealed Secrets during the secret rotation flow (/v1/rotate). The rotation process derives the new sealing scope from input SealedSecret metadata, and untrusted annotations in the template can widen the scope to cluster-wide (sealedsecrets.bitnami.com/cluster-wide=t...