GO-2026-4942 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, zot, portieris, kots, gitness, envoy-gateway...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy, opa-fips-envoy...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2026-4771 vulnerabilities

Vulnerabilities for packages: gitaly, vault, commercial-grafana, envoy-gateway-fips, teleport, vault-fips...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, k3s, kots, commercial-chainloop-backend, spire-server, commercial-grafana, envoy-gateway-fips, kine, envoy-gateway...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-cli-fips, conftest, xeol-fips, kyverno-fips, headlamp, argocd-image-updater, cluster-api-helm-controller-fips, rancher-fleet, cilium-cli, headlamp-fips, argo-cd, falcoctl-fips, falcoctl, ratify, ocm-kubernetes-controller, xeol, trivy, drone, helm-set-status,...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: kots, portieris-fips, gitlab-rails-ce, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, portieris, gitness, envoy-gateway, argocd-image-updater...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: kots, portieris-fips, gitlab-rails-ce, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, portieris, gitness, envoy-gateway, argocd-image-updater...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: gitaly, splunk-otel-collector, opentelemetry-collector, opentelemetry-collector-fips, dagger, frankenphp-8.4, docker, fleet-server, vault, jaeger-fips, flyte, buildkitd-fips, google-cloud-otel-ops-collector, opentelemetry-operator, external-dns, elastic-agent,...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: k9s, nsc, guac, envoy-gateway, zarf, gptscript, gitleaks, rancher-fleet, terraform, kubescape-operator, podman, undock, trivy-operator, trufflehog, steampipe, terragrunt, zot, grafana-alloy, xeol, trivy, filebrowser, nuclei, vcluster, gitness, opentofu, tflint...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: spire-server, kine, kots, envoy-gateway, k3s...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: k9s, kots, cilium-cli, envoy-gateway, cerbos, zarf, k8sgpt, chart-testing, linkerd2, rancher-fleet, tw, eksctl, helm-operator, pluto, flux-helm-controller, kargo, helm-push, zot, istio, cluster-api-helm-controller, cert-manager-cmctl, rancher-helm, trivy,...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, zot, portieris, kots, gitness, envoy-gateway...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, zot, portieris, kots, gitness, envoy-gateway...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: net-kourier, falcosidekick, cilium, ferretdb, kiali, kots, prometheus-alertmanager, envoy-gateway, splunk-otel-collector, weaviate, aactl, harbor-registry, k6, opa-envoy, flyte, grafana-image-renderer, terragrunt, hydra, prometheus, buildkitd, tkn, op-geth,...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673

Kong Mesh CVE-2026-18673 affects kuma-dp readiness service. When Envoy admin API is exposed on a TCP port (9902) while the Envoy admin API is connected to a Unix domain socket by default, the readiness endpoint forwards a large portion of the Envoy admin API to any caller on the port without auth...