166 matches found
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover
Cluster-Chaos-Explotando-CVE-2025-59359-para-la-Toma-de-Kubernetes Un recorrido forense práctico de CVE-2025-59359, una falla crítica de inyección de comandos del sistema operativo en Chaos-Mesh. Aprenda cómo los atacantes secuestran clústeres de Kubernetes a través de mutaciones de GraphQL, y có...
CVE-2026-20182
CVE-2026-20182 Omisión de autenticación de peering en Cisco Catalyst SD-WAN CVE-2026-20182 — Omisión de autenticación de peering en Cisco Catalyst SD-WAN Herramienta de evaluación para pruebas autorizadas de la omisión de autenticación de peering en Cisco Catalyst SD-WAN Controller / Manager...
CVE-2026-2270
A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...
PT-2026-97726
Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Medium 5.9 A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting thi...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: node-feature-discovery, kyverno, emissary, flux-kustomize-controller, tkn, apisix-ingress-controller, azure-service-operator, cloud-provider-azure, cluster-api-azure-controller, fluent-operator, kubescape, k3s, caddy, gitlab-kas, external-secrets-operator, openbao,...
GO-2025-3774 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-driver-hostpath, mesosphere-vsphere-csi, emissary, rancher-fleet, yunikorn-k8shim, cloud-provider-gcp-cloud-controller-manager, rancher-system-agent, docker-machine-driver-harvester, vcluster...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: delve, tkn, nginx-prometheus-exporter, cerbos, aws-application-networking-k8s, helm-set-status, nuclei, cloud-provider-vsphere, ratify, bom, yunikorn-k8shim, rancher-system-upgrade-controller, ipfs-cluster, harbor-registry, opa, envconsul, trivy, kind, nri-apache, ko...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: node-feature-discovery, kyverno, emissary, flux-kustomize-controller, tkn, apisix-ingress-controller, azure-service-operator, cloud-provider-azure, cluster-api-azure-controller, fluent-operator, kubescape, k3s, caddy, gitlab-kas, external-secrets-operator, openbao,...
Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...
RHCOS 4 : OpenShift Container Platform 4.2.36 openshift (RHSA-2020:2594)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2594 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...
RHCOS 4 : OpenShift Container Platform 4.4.8 openshift (RHSA-2020:2448)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2448 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: mig-parted-fips, prometheus-blackbox-exporter-fips, longhorn-cli, crossplane-provider-aws-firehose-fips, crossplane-provider-aws-wafv2, buildah-fips, kubernetes-replicator-fips, prometheus-postgres-exporter, nsc, argo-cd, cerbos, nri-apache, kubernetes-dashboard-fips...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-wafv2, kubernetes-replicator-fips, prometheus-postgres-exporter, cerbos, nri-apache, aws-flb-firehose-fips, kubescape-operator-fips, tofu-controller, sbomqs, authservice-fips, yq, kube-vip-fips, coredns-fips, cloud-provider-azure,...
Cisco Catalyst SD-WAN Controller Authentication Bypass (cisco-sa-sdwan-rpa-EHchtZk)
According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an...
OESA-2026-1162 kubernetes security update
Container cluster management. Security Fixes: A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the...
GO-2025-4240 Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes...
