Fleet: ORDER BY column injection on activity list endpoints

Summary An authenticated user with read access to Activity could influence the ORDER BY clause of the activity list endpoints by supplying an arbitrary sort column: - GET /api/v1/fleet/activities ListActivities - GET /api/v1/fleet/hosts/id/activities ListHostPastActivities This originated from th...

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers...

GHSA-7Q96-F8XW-JV5J Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

CVE-2026-75112

OTTO® Fleet Manager uses an insufficient bcrypt work factor, lowering the computational cost for offline brute-force attacks on stored password hashes if an attacker obtains an unencrypted system backup. CVSS 6.9 (Medium), ADJACENT vector. No exploitation reported; Rockwell advisory SD1791 refere...

EUVD-2026-62694

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

CVE-2026-75112 OTTO® Fleet Manager – Weak Password Hashing Configuration

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password...

BIT-KIBANA-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

BIT-ELK-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

EUVD-2026-61152

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: helm-push, cert-manager-cmctl, helm-diff-fips, helm-diff, rancher-fleet-fips, kuma, rancher-fleet, kots, zarf, flux-fips, cilium-cli, zarf-fips, flux-source-controller, flux-source-controller-fips, cert-manager-cmctl-fips, flux, gitlab-operator, gitlab-operator-fips...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: helm-push, cert-manager-cmctl, helm-diff-fips, helm-diff, rancher-fleet-fips, kuma, rancher-fleet, kots, zarf, flux-fips, cilium-cli, zarf-fips, flux-source-controller, flux-source-controller-fips, cert-manager-cmctl-fips, flux, gitlab-operator, gitlab-operator-fips...

GO-2026-4316 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, custom-pod-autoscaler-fips, aws-lambda-runtime-interface-emulator-fips, custom-pod-autoscaler, fleet-server-fips, cloudbeat, commercial-kyverno, kyverno-fips, aws-lambda-runtime-interface-emulator...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: kubescape-operator-fips, kargo, trivy-operator, argo-cd-fips, falcoctl-fips, helm-push, cert-manager-cmctl, conftest-fips, ratify-fips, k9s-fips, tigera-operator, argocd-image-updater, gatekeeper, rancher-fleet-fips, conftest, steampipe, cloudbeat-fips,...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: trivy, envoy-gateway, vcluster, gptscript, rancher-fleet, filebrowser, nuclei, tflint, steampipe, undock, podman, terragrunt, kubescape-operator, gitleaks, terraform, trufflehog, xeol, k9s, gitness, guac, grafana-alloy, zot, nsc, zarf, trivy-operator, opentofu...

GO-2026-5566 vulnerabilities

Vulnerabilities for packages: cilium-cli, kots, zarf, rancher-fleet, helm-push, flux, flux-source-controller, kuma, cert-manager-cmctl...

GO-2026-5666 vulnerabilities

Vulnerabilities for packages: cilium-cli, kots, zarf, rancher-fleet, helm-push, flux, flux-source-controller, kuma, cert-manager-cmctl...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: chartmuseum, trivy, envoy-gateway, cluster-api-helm-controller, tw, rancher-fleet, kargo, helm-operator, eksctl, istio, flux-source-controller, cert-manager-cmctl, cilium-cli, cerbos, k8sgpt, k9s, zot, helm-push, rancher-helm, flux-helm-controller, k8ssandra-client,...