GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rancher-helm, libnvidia-container, flux-image-automation-controller, apisix-ingress-controller, aws-flb-firehose, grafana-rollout-operator, hubble, rancher-agent, cilium-cli, contour, external-secrets-operator, timoni, helm-set-status, nuclei, syft, cerbos, keda, wav...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: rancher-helm, libnvidia-container, flux-image-automation-controller, apisix-ingress-controller, aws-flb-firehose, grafana-rollout-operator, hubble, rancher-agent, cilium-cli, contour, external-secrets-operator, timoni, helm-set-status, nuclei, syft, cerbos, keda, wav...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: libnvidia-container, hubble, kubernetes-replicator, external-secrets-operator, timoni, falco-no-driver, hugo-extended, tetragon, redka, cilium-envoy, nerdctl, mattermost, policy-controller, kubernetes-event-exporter, dive, cloud-provider-vsphere, step-kms-plugin,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: omnibump, commercial-chainloop-backend, flux, malcontent, metacontroller, external-secrets-operator, sealed-secrets-fips, nodetaint, envoy-ratelimit-fips, flux-image-automation-controller, flux-operator-fips, supercronic, cilium-fips, envoy-ratelimit,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: omnibump, commercial-chainloop-backend, flux, malcontent, metacontroller, external-secrets-operator, sealed-secrets-fips, nodetaint, envoy-ratelimit-fips, flux-image-automation-controller, flux-operator-fips, supercronic, cilium-fips, envoy-ratelimit,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, istio-fips, kubernetes-csi-external-resizer-fips, cilium-fips, knative-net-istio-fips, libnvidia-container, libnvidia-container-fips, docker-compose-fips, docker-cli-fips, contour-fips, spegel-fips,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, istio-fips, kubernetes-csi-external-resizer-fips, cilium-fips, knative-net-istio-fips, libnvidia-container, libnvidia-container-fips, docker-compose-fips, docker-cli-fips, contour-fips, spegel-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, nri-elasticsearch, yunikorn-web-fips, kubernetes-ingress-defaultbackend-fips, malcontent, nodetaint, pushprox-fips, istio-fips, kubeflow-fips, rancher-pushprox,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, nri-elasticsearch, yunikorn-web-fips, kubernetes-ingress-defaultbackend-fips, malcontent, nodetaint, pushprox-fips, istio-fips, kubeflow-fips, rancher-pushprox,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: yunikorn-web-fips, nodetaint, pushprox-fips, kubeflow-fips, cilium-fips, docker-compose-fips, flannel-cni-plugin-fips, spegel-fips, nats-top, nodetaint-fips, spicedb-operator, atlas-fips, aws-iam-authenticator-fips, nri-couchbase, bom, envconsul-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, nri-elasticsearch, yunikorn-web-fips, kubernetes-ingress-defaultbackend-fips, malcontent, nodetaint, pushprox-fips, istio-fips, kubeflow-fips, rancher-pushprox,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, nri-elasticsearch, yunikorn-web-fips, kubernetes-ingress-defaultbackend-fips, malcontent, nodetaint, pushprox-fips, istio-fips, kubeflow-fips, rancher-pushprox,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, promxy-fips, crossplane-provider-aws-elasticache-fips, migrate, nri-elasticsearch, yunikorn-web-fips, kubernetes-ingress-defaultbackend-fips, malcontent, nodetaint, pushprox-fips, istio-fips, kubeflow-fips, rancher-pushprox,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the dashboard log endpoints. An attacker can access sensitive operational log data by sending authenticated requests to the log endpoints without requiring elevated privileges. Remediation Upgrade...

GHSA-CP79-9MWR-WR49 Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Summary Ech0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope. Impact Any valid user session can access GET...

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Summary Ech0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope. Impact Any valid user session can access GET...

EUVD-2026-21547

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the odh-dashboard component of Red Hat OpenShift AI RHOAI allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to...

CVE-2026-5483

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the odh-dashboard component of Red Hat OpenShift AI RHOAI allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to...

CVE-2026-5483

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the odh-dashboard component of Red Hat OpenShift AI RHOAI allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to...

CVE-2026-5483 Odh-dashboard: odh dashboard kubernetes service account exposure

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the odh-dashboard component of Red Hat OpenShift AI RHOAI allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to...