167 matches found
CVE-2026-20182
CVE-2026-20182 Cisco Catalyst SD-WAN Peering Authentication Bypass CVE-2026-20182 — Cisco Catalyst SD-WAN Peering Authentication Bypass Assessment tool for authorized testing of Cisco Catalyst SD-WAN Controller / Manager peering authentication bypass CVE-2026-20182. | ---|--- CVE| CVE-2026-20182...
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover A hands-on forensic walkthrough of CVE-2025-59359, a critical OS command injection flaw in Chaos-Mesh. Learn how attackers hijack Kubernetes clusters via GraphQL mutations, and how to detect, analyze, and report the breach using ELK...
CVE-2026-2270
A flaw was found in Kubernetes kube-controller-manager. The StatefulSet controller restores ControllerRevision data onto the whole StatefulSet object, including metadata. A user with namespace-scoped write access to StatefulSet and ControllerRevision can cause the controller to create a pod in...
PT-2026-97726
Name of the Vulnerable Software and Affected Versions Kubernetes affected versions not specified Description A confused deputy attack in the kube-controller-manager allows a user with write permissions for StatefulSet and ControllerRevision objects within their own namespace to potentially create...
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N - Medium 5.9 A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting thi...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: openfga, cilium, cloud-provider-azure, k3s, kubernetes-csi-external-snapshotter, caddy, azure-service-operator, cluster-api-provider-vsphere, cloud-provider-gcp-cloud-controller-manager, cluster-api-gcp-controller, opentelemetry-operator, datadog-agent, descheduler,...
GO-2025-3774 vulnerabilities
Vulnerabilities for packages: rancher-system-agent, docker-machine-driver-harvester, mesosphere-vsphere-csi, cloud-provider-gcp-cloud-controller-manager, rancher-fleet, vcluster, yunikorn-k8shim, emissary, kubernetes-csi-driver-hostpath...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: kubecolor, lazydocker, trivy, k3s, portieris, clickhouse-operator, azure-service-operator, kubernetes-csi-driver-nfs, falcoctl, ratify, src, argo-events, rclone, tkn, docker-machine-driver-harvester, harbor-cli, kpt, kor, kubernetes-dashboard-api, cilium-cli,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: openfga, cilium, cloud-provider-azure, k3s, kubernetes-csi-external-snapshotter, caddy, azure-service-operator, cluster-api-provider-vsphere, cloud-provider-gcp-cloud-controller-manager, cluster-api-gcp-controller, opentelemetry-operator, datadog-agent, descheduler,...
Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...
RHCOS 4 : OpenShift Container Platform 4.2.36 openshift (RHSA-2020:2594)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2594 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...
RHCOS 4 : OpenShift Container Platform 4.4.8 openshift (RHSA-2020:2448)
The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2448 advisory. - kubernetes: Server side request forgery SSRF in kube-controller-manager allows users to leak secret information CVE-2020-8555 Note that...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: terraform-provider-azapi-fips, karpenter-fips, prometheus, prometheus-redis-exporter-fips, db-operator, commercial-chainloop-backend, kubernetes-csi-livenessprobe, crossplane-provider-aws-rolesanywhere-fips, nri-discovery-kubernetes, rancher-webhook, request-1279,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: terraform-provider-azapi-fips, db-operator, kubernetes-csi-livenessprobe, hcl2json, prometheus-stackdriver-exporter, sftpgo-plugin-geoipfilter, yunikorn-web, knative-storage-migrate, neuvector-scanner-fips, crossplane-provider-aws-wafv2, virt-handler-fips,...
Cisco Catalyst SD-WAN Controller Authentication Bypass (cisco-sa-sdwan-rpa-EHchtZk)
According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an...
OESA-2026-1162 kubernetes security update
Container cluster management. Security Fixes: A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the...
GO-2025-4240 Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes...
