CVE-2026-54246 Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...

GHSA-398H-7F66-3H4P open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters

Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented NAMESPACE/NAME syntax. The operator resolves the referenced resource cluster-wide and materializes its contents env...