CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: pluto, helm-mapkubeapis, envoy-gateway, cert-manager-cmctl, chartmuseum, harbor, trivy-operator, eksctl, cerbos, cilium-cli, nova, helm-push, kuma, linkerd2, helm-set-status, tw, trivy, flux-source-controller, helm-operator, flux, consul-k8s, k8ssandra-client, zot,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: pluto, helm-mapkubeapis, envoy-gateway, cert-manager-cmctl, chartmuseum, harbor, trivy-operator, eksctl, cerbos, cilium-cli, nova, helm-push, kuma, linkerd2, helm-set-status, tw, trivy, flux-source-controller, helm-operator, flux, consul-k8s, k8ssandra-client, zot,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: pluto, aws-privateca-issuer, flux-image-automation-controller, malcontent, metacontroller, github-mcp-server, supercronic, smokescreen, dataplaneapi, stakater-reloader, karpenter, aws-network-policy-agent, ingress-nginx-controller, apko, grafana-operator,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, cluster-api-ipam-provider-in-cluster, redka, metacontroller, prometheus-operator, spicedb-operator, docker-cli-buildx, newrelic-infra-operator, clickhouse-operator, smarter-device-manager, external-secrets-operator, kubewatch, delve,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, gatus, lazydocker, crossplane, boring-registry, xeol, kine, flux-image-automation-controller, redka, jitsucom-bulker, kwok, prometheus-operator, docker-machine-driver-harvester, crossplane-provider-keycloak, ingress-nginx-controller, gitness,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, cluster-api-ipam-provider-in-cluster, redka, metacontroller, prometheus-operator, spicedb-operator, docker-cli-buildx, newrelic-infra-operator, clickhouse-operator, external-secrets-operator, kubewatch, delve, kserve-modelmesh-serving, otel-cli,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, cluster-api-ipam-provider-in-cluster, redka, metacontroller, prometheus-operator, spicedb-operator, docker-cli-buildx, newrelic-infra-operator, clickhouse-operator, external-secrets-operator, kubewatch, delve, kserve-modelmesh-serving, otel-cli,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: pluto, helm-diff, helm-mapkubeapis, gitlab-operator-fips, linkerd2-fips, envoy-gateway, k8ssandra-client-fips, cerbos-fips, kube-arangodb-fips, cert-manager-cmctl, flux-source-controller-fips, chartmuseum, helm-exporter, cloudbeat, harbor, k9s-fips, pluto-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, crossplane-provider-aws-memorydb-fips, omni-fips, yunikorn-k8shim-fips, cluster-api-ipam-provider-in-cluster, addon-resizer-fips, gitea-fips, wavefront-collector-for-kubernetes, logstash-exporter-fips, redka, victoriametrics-operator-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, crossplane-provider-aws-memorydb-fips, wire-go, addon-resizer-fips, cephcsi-fips, kcp-fips, mattermost-fips, spicedb-operator, docker-cli-buildx, otel-cli, vault-env, yunikorn-k8shim, tempo-fips, knative-net-istio-fips, gatus-fips,...

PT-2026-32126

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

Juju: CloudSpec method leaking cloud credentials

Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...

EUVD-2026-21364

Juju: CloudSpec method leaking cloud credentials...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the CloudSpec method on the Controller facade. An attacker can obtain sensitive cloud credentials by making an authenticated API call with only basic login permissions, without requiring elevated privileges...

GHSA-W5FQ-8965-C969 Juju: CloudSpec method leaking cloud credentials

Impact If a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller. The CloudSpec API is called by workers running in the controller to maintain connectio...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

CVE-2026-5412

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...