CVE-2026-20182

CVE-2026-20182 Cisco Catalyst SD-WAN Peering Authentication Bypass CVE-2026-20182 — Cisco Catalyst SD-WAN Peering Authentication Bypass Assessment tool for authorized testing of Cisco Catalyst SD-WAN Controller / Manager peering authentication bypass CVE-2026-20182. | ---|--- CVE| CVE-2026-20182...

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover

Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover A hands-on forensic walkthrough of CVE-2025-59359, a critical OS command injection flaw in Chaos-Mesh. Learn how attackers hijack Kubernetes clusters via GraphQL mutations, and how to detect, analyze, and report the breach using ELK...

CVE-2026-2270

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metada...

CLEANSTART-2026-RX78395 Security fix for GHSA-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.20.0-r3, eks-distro-kube-scheduler 1.36.9-r2, eks-distro-kube-controller-manager-fips 1.36.8-r0, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

GHSA-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZS73776 Security fix for GHSA-8wmf-6v46-5gfg applied in: eks-distro-kube-scheduler-fips 1.35.14-r0, eks-distro-kube-controller-manager-fips 1.36.8-r1, eks-distro-kube-apiserver 1.36.8-r2, eks-distro-kube-apiserver-fips 1.36.8-r1

GHSA-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-2270

A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...

PT-2026-97726

Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...

StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Medium 5.9 A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting thi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, kyverno-notation-aws, hubble-ui, grafana, kapp-controller, kyverno, openbao, k3s, rancher-system-agent, pulumi-kubernetes-operator, cluster-api-azure-controller, flux-kustomize-controller, kubescape, gitlab-kas, spqr, caddy,...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, rancher-fleet, cloud-provider-gcp-cloud-controller-manager, vcluster, yunikorn-k8shim, mesosphere-vsphere-csi, emissary, rancher-system-agent, kubernetes-csi-driver-hostpath...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-set-status, rclone, tflint, timescaledb-tune, conftest, k3s, fulcio, rancher-system-agent, cluster-api-azure-controller, undock, nri-memcached, nri-nginx, kubernetes-csi-driver-hostpath, nri-f5, rabbitmq-messaging-topology-operator, kubernetes-dashboard,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: external-secrets-operator, kyverno-notation-aws, hubble-ui, grafana, kapp-controller, kyverno, openbao, k3s, rancher-system-agent, pulumi-kubernetes-operator, cluster-api-azure-controller, flux-kustomize-controller, kubescape, gitlab-kas, spqr, caddy,...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...

RHCOS 4 : OpenShift Container Platform 4.2.36 openshift (RHSA-2020:2594)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2594 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...

RHCOS 4 : OpenShift Container Platform 4.4.8 openshift (RHSA-2020:2448)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2448 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: docker-cli, ingress-nginx-controller-fips, aws-eks-pod-identity-agent, cert-manager-cmctl, kube-arangodb-fips, flux-source-watcher, scorecard, bento, commercial-chainloop-backend, terraform-provider-databricks, eks-node-monitoring-agent, prometheus-adapter, langfuse,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: scorecard, bento, commercial-chainloop-backend, terraform-provider-databricks, eks-node-monitoring-agent, kubernetes-dashboard, chainguard-partners-demo, calico, nri-apache, iptables-wrappers, crossplane-provider-family-azure, kwok, filebrowser,...

Cisco Catalyst SD-WAN Controller Authentication Bypass (cisco-sa-sdwan-rpa-EHchtZk)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an...

OESA-2026-1162 kubernetes security update

Container cluster management. Security Fixes: A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the...