104 matches found
CVE-2026-32794
CVE-2026-32794：Apache Airflow Databricks 提供程序中的 TLS 证书验证绕过 关键词： TLS、证书验证、MITM、Kubernetes、Databricks、OAuth、CWE-295、Apache Airflow 目录 概述 漏洞详情 技术分析 攻击链 影响 修复方案 时间线 参考资料 联系方式 免责声明 概述 apache-airflow-providers-databricks 包在与 Kubernetes API 服务器通信进行联合令牌交换时，禁用了 TLS 证书验证。同步和异步代码路径均使用 verify=False /...
PYSEC-2026-3873 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeon Project: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing" Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
Reporter: Aaron / Aeon — autonomous security agent https://github.com/aaronjmars/aeonProject: omnigent-ai/omnigent v0.1.0 Databricks — meta-harness running Claude Code / Codex / Pi "in check with policies and sandboxing"Component: omnigent/policies/builtins/shell.py shared parser → consumed by...
GHSA-JPJM-C3R5-Q96R vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, flux-source-controller, cluster-api-gcp-controller, kyverno-fips, crossplane-provider-aws-batch, terraform-provider-time-fips, external-secrets-fips, beats, crossplane-provider-azure-streamanalytics, caddy, crossplane-provider-azure-storagecache,...
CVE-2026-56852 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, flux-source-controller, cluster-api-gcp-controller, kyverno-fips, crossplane-provider-aws-batch, terraform-provider-time-fips, external-secrets-fips, beats, crossplane-provider-azure-streamanalytics, caddy, crossplane-provider-azure-storagecache,...
PYSEC-2026-2655 MLFlow Creates a Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
MLFlow Creates a Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
PYSEC-2026-2357 Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...
Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...
PT-2026-59038
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...
MLflow has a Local File Read/Path Traversal in dbfs
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...
GHSA-Q4H4-GMJ2-QVW2 vulnerabilities
Vulnerabilities for packages: flux-source-controller, kyverno-fips, external-secrets-fips, crossplane-provider-azure-streamanalytics, caddy, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, vitess, crossplane-provider-aws-lexmodels, upwind-agent,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: flux-source-controller, kyverno-fips, external-secrets-fips, crossplane-provider-azure-streamanalytics, caddy, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, vitess, crossplane-provider-aws-lexmodels, upwind-agent,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: cluster-api-gcp-controller, kyverno-fips, seaweedfs-operator, external-secrets-fips, beats, crossplane-provider-azure-streamanalytics, caddy, cloud-provider-aws-fips, crossplane-provider-azure-storagecache, vitess, crossplane-provider-aws-imagebuilder-fips,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: cluster-api-gcp-controller, kyverno-fips, seaweedfs-operator, external-secrets-fips, beats, crossplane-provider-azure-streamanalytics, caddy, cloud-provider-aws-fips, crossplane-provider-azure-storagecache, vitess, crossplane-provider-aws-imagebuilder-fips,...
Malicious code in databricks-tools-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-5809 Malicious code in databricks-tools-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ecf172545ef84f1fcbeeae028a55d2bb570d68a3356a26526269e267f184a10 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
GHSA-W2Q5-6Q6X-X959 vulnerabilities
Vulnerabilities for packages: flux-source-watcher, helm-exporter, gpu-operator, crossplane-provider-aws-batch, trivy-k8s-wrapper-fips, cluster-proportional-autoscaler-fips, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, fairwinds-gemini, upwind-agent,...
GHSA-F2M9-WCF4-CWWX MLFlow Creates a Temporary File With Insecure Permissions
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...
EUVD-2026-30807
In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...