PT-2026-63723

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63762

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: minio-object-browser, glab, keda, crossplane-provider-aws-sesv2-fips, rancher, listmonk, kyverno, kubevirt-cdi-controller-fips, crossplane-provider-aws-globalaccelerator, ksops, nova, nerdctl, cluster-api-azure-controller, clickhouse-backup, neuvector-scanner,...

Improper Authorization

github.com/coder/coder is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation in the UpsertWorkspaceApp and insertAgentApp functions, which fail to verify that a supplied application ID belongs to the workspace being built before performing a cross-workspace...

CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

PT-2026-56073

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 Description An issue exists where the UpsertWorkspaceApp function overwrites an existing application's agent id during...

CLEANSTART-2026-WS85269 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: malcontent, karpenter, pluto, nfs-subdir-external-provisioner, smokescreen, omnibump, secrets-store-csi-driver-provider-aws, aws-privateca-issuer, hubble, newrelic-infra-operator, external-secrets-operator, aws-network-policy-agent, spire-server, tailscale,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: flux-helm-controller-fips, prometheus-elasticsearch-exporter, glab, keda, trufflehog, gomplate, kyverno, skopeo, go-md2man, kubelet-csr-approver-fips, kubescape, trivy-operator, mkcert, vault-csi-provider, azure-aad-pod-identity-mic, grpcurl, rekor-fips,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner, kaf, runc, spicedb, terraform-provider-aws, crossplane-provider-azure-storage, cert-exporter, crossplane-provider-aws, crossplane-provider-aws-lambda, crossplane-provider-aws-cloudfront, newrelic-infrastructure-agent, cadvisor,...

GHSA-F4W6-3RH6-6Q4Q vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner...

GHSA-F4W6-3RH6-6Q4Q vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-provisioner...

GHSA-F4W6-3RH6-6Q4Q Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

kubernetes-csi: CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

CVE-2019-11255

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner v0.4.3, v1.0.2, v1.1, v1.2.2, v1.3.1, external-snapshotter v0.4.2, v1.0.2, v1.1, 1.2.2, and external-resizer v0.1, v0.2 could result in unauthorized PersistentVolume data access or volume mutation during...

PT-2019-4222

Name of the Vulnerable Software and Affected Versions Kubernetes CSI sidecar containers for external-provisioner versions prior to 0.4.3, prior to 1.0.2, 1.1, prior to 1.2.2, prior to 1.3.1 Kubernetes CSI sidecar containers for external-snapshotter versions prior to 0.4.2, prior to 1.0.2, 1.1,...