50 matches found
CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability
CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability 作者：Mark Mallia 容器化与自动化的力量 容器化是现代应用交付的支柱：它将完整的运行时堆栈打包成一个单一的、不可变的镜像，可以在集群中的任何主机上无意外地部署。Kubernetes 将这些镜像调度为 Pod，通过声明式模型协调从网络到存储的一切。这在高度分布式的环境以及同时服务多个应用的环境中非常有用。 该技术栈在大型工作负载中尤其引人注目的原因在于，它能够通过自动化实现端到端管理。Terraform 提供基础设施即代码蓝图，用于创建...
cve-2024-10220-test
CVE-2024-10220 测试仓库 此仓库用于测试 CVE-2024-10220（Kubernetes gitRepo volume 漏洞），作为中俄克拉荷马大学 HPC 安全研究的一部分。 警告： 此仓库包含用于受控安全测试的恶意 Git 钩子。请勿在生产环境中使用。 漏洞详情 CVE: CVE-2024-10220 组件： Kubernetes kubelet gitRepo volumes 影响： Kubernetes 节点上的任意命令执行 严重性： 高 CVSS 8.1 研究目的 此仓库是对 HPC 作业调度器（Slurm, HTCondor,...
CVE-2026-75036
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...
CVE-2026-75036
Fleet (Rancher's GitOps operator) is vulnerable to DNS-based information disclosure during Helm template preprocessing. The Sprig getHostByName function, evaluated by the Fleet controller, can reach network resources outside the management cluster, allowing a user who can supply bundle content to...
CVE-2026-44948 Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...
Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017390)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017390 advisory. The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
EUVD-2026-23963
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths...
GHSA-X3J7-7PGJ-H87R Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604 Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604 Spinnaker vulnerable to RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths
Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions...
CVE-2026-32604
CVE-2026-32604 affects Spinnaker before the patched releases 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2. The vulnerability arises in clouddriver components when handling gitrepo artifacts, allowing a bad actor to execute arbitrary commands on the pod (RCE) by exploiting improper input handling on...
PT-2026-33842
Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.0 Spinnaker versions prior to 2026.0.1 Spinnaker versions prior to 2025.4.2 Spinnaker versions prior to 2025.3.2 Description An issue in the clouddriver pods allows an attacker to execute arbitrary commands...
EUVD-2025-6386
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2025-1767
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the...
GHSA-XGPC-Q899-67P8 Fleet doesn’t validate a server’s certificate when connecting through SSH
Impact A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the knownhosts file. This could allow the execution of a man-in-the-middle MitM attack against Fleet...