Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

Summary CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's apiCall context by validating the URLPath field. However, the ConfigMap context loader has the identical vulnerability — the configMap.namespace field accepts any namespace with zero validation, allowing a namespace...

GHSA-CVQ5-HHX3-F99P Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)

Summary CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's apiCall context by validating the URLPath field. However, the ConfigMap context loader has the identical vulnerability — the configMap.namespace field accepts any namespace with zero validation, allowing a namespace...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: smarter-device-manager, mountpoint-s3-csi-driver, kubernetes-csi-external-health-monitor, postgres-operator, knative-client, cloud-provider-azure, helm, vexctl, grafana-agent-operator, multus-cni, grafana-rollout-operator, prometheus-blackbox-exporter, sbom-convert,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: swagger, spiffe-helper-fips, kubernetes-dns-node-cache, grafana-operator-fips, karpenter-fips, blob-csi, qemu-guesthelper, kubernetes-dashboard-api, prometheus-node-exporter, terraform-provider-tls-fips, tempo, node-feature-discovery-fips, spark-operator-fips,...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

SUSE CVE-2025-64432

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the virt-api component failing to validate the CN field in client TLS certificates against allowed values in the extension-apiserver-authentication configmap. An attacker can...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to the virt-api component failing to validate the CN field in client TLS certificates against allowed values in the extension-apiserver-authentication configmap. An attacker can...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: smarter-device-manager, kubernetes-csi-external-health-monitor, pulumi-kubernetes-operator, juicefs, vexctl, grafana-agent-operator, prometheus-blackbox-exporter, sbom-convert, vendir, aws-signer-notation-plugin, kubernetes-replicator, custom-pod-autoscaler, gotestsu...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter, nodetaint, ko, juicefs, vexct...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter, ko, juicefs, vexctl, otel-cli...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter, nodetaint, ko, juicefs, vexct...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, tfsec, harbor, kubescape-operator, smarter-device-manager, kubernetes-csi-external-health-monitor, kpt, delve, pulumi-kubernetes-operator, metrics-server, policy-controller, docker-credential-acr-env, render-template, k3d, cert-exporter,...