11551 matches found
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
Summary The HTTP resolver's FetchHttpResource function calls io.ReadAllresp.Body with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response...
CVE-2026-40868 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header...
CVE-2026-40868 kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header...
CVE-2026-40868
Kyverno pre-1.16.4 apiCall serviceCall implicitly injects the Authorization: Bearer token from the kyverno serviceaccount when a policy omits an Authorization header. Since context.apiCall.service.url is policy-controlled, this can leak the serviceaccount token to attacker-controlled endpoints (c...
CVE-2026-40050
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability CVE-2026-40050 in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability...
Improper Access Control
github.com/redhatinsights/runtimes-inventory-operator is vulnerable to improper access control. The vulnerability is due to a misconfigured internal proxy that attaches administrative credentials to all commands, which allows a standard user to send unauthorized commands and gain full cluster...
Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011267)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011267 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stal...
Dell Storage Manager Privilege Escalation
The vulnerability of Dell Storage Manager’s cluster management software is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...
CVE-2026-40050: Missing Authentication for Critical Function
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability CVE-2026-40050 in LogScale. This vulnerability only requires mitigation by customers that host specific versions of LogScale and does not affect Next-Gen SIEM customers. The vulnerability...
CrowdStrike LogScale security vulnerabilities
CrowdStrike LogScale is a high-performance log management and analysis platform developed by the CrowdStrike company in the United States. There is a security vulnerability in CrowdStrike LogScale, which stems from an unvalidated path traversal issue in certain cluster API endpoints. This...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011006)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011006 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in userclusterconnect userclusterdisconnect frees conn-ccprivate which is ...
Unity Linux 20.1050e / 20.1060e Security Update: kernel (UTSA-2026-007624)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007624 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in userclusterconnect userclusterdisconnect frees conn-ccprivate which is ...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007582)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007582 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stal...
GHSA-F9G8-6PPC-PQQ4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
Summary Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has no validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions ...
CLEANSTART-2026-VZ35122 filippo
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. filippo. See references for individual vulnerability details...
CLEANSTART-2026-IY92636 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it...
CLEANSTART-2026-TZ92532 filippo
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. filippo. See references for individual vulnerability details...
CLEANSTART-2026-JZ43336 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...