GO-2025-3922 vulnerabilities

Vulnerabilities for packages: terragrunt, gitleaks, nsc, opentofu, gitness, undock, zarf, podman, zot, terraform, gptscript, trivy-operator, trufflehog, vcluster, steampipe, rancher-fleet, filebrowser, grafana-alloy, k9s, trivy, tflint, kubescape-operator, envoy-gateway, guac, xeol, nuclei...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: kine, spire-server, k3s, envoy-gateway, kots...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: helm-operator, k8ssandra-client, helm-push, zarf, istio, zot, cerbos, rancher-fleet, k8sgpt, cert-manager-cmctl, linkerd2, rancher-helm, k9s, kots, trivy, cilium-cli, helm-docs, eksctl, tw, flux-helm-controller, kargo, chartmuseum, pluto, cluster-api-helm-controller,...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, gitness, zot, kots...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, portieris, envoy-gateway, gitness, zot, kots...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: spicedb, ferretdb, argo-workflows, op-geth, containerd, harbor, opentelemetry-operator, gatekeeper, envoy-ratelimit, flux, keda, aws-otel-collector, prometheus-alertmanager, ingress-nginx-controller, knative-eventing, opentelemetry-collector-contrib,...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673

Kong Mesh CVE-2026-18673 affects kuma-dp readiness service. When Envoy admin API is exposed on a TCP port (9902) while the Envoy admin API is connected to a Unix domain socket by default, the readiness endpoint forwards a large portion of the Envoy admin API to any caller on the port without auth...

PT-2026-71205

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.11

Red Hat OpenShift Service Mesh 3.1.11 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.14

Red Hat OpenShift Service Mesh 3.0.14 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

SUSE CVE-2026-49445

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

CLEANSTART-2026-WD10731 Security fixes in envoy-ratelimit 0.0.0_git20251231-r1

Package envoy-ratelimit version 0.0.0git20251231-r1 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-QT61211 Security fixes in envoy-ratelimit 0.0.0_git20251231-r0

Package envoy-ratelimit version 0.0.0git20251231-r0 fixes 14 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-24051, CVE-2025-61726...

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

aap-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed...

BIT-HUBBLE-RELAY-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...

BIT-CILIUM-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints,...