CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Token de cuenta de servicio de Kubernetes montado en HostPath Código del programa YAML + exploit en Python vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: ...

BIT-KYVERNO-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

PT-2026-98995

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

A flaw was found in Kyverno. This policy exception handling flaw allows a remote attacker to bypass security policies. By crafting a resource name that matches a less restrictive exception pattern, an attacker can circumvent policies, such as those blocking hostPath volumes, leading to unauthoriz...

SUSE CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200: Improper Access Control

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, azurefile-csi, harvester, harvester-fips, azuredisk-csi, longhorn-manager, longhorn-manager-fips, rke2-runtime-fips, cluster-autoscaler-fips, kubernetes-csi-driver-hostpath, azurefile-csi-fips, longhorn-share-manager-fips, longhorn-share-manager,...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: spark-operator, aws-ebs-csi-driver, nodetaint, kubernetes, local-static-provisioner, rancher-webhook-fips, kubeflow-pipelines, argocd-image-updater-fips, aws-efs-csi-driver, ip-masq-agent, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache,...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: grafana-mimir, cloudnative-pg, kubernetes-csi-driver-hostpath, grpc-health-probe, cert-manager-cmctl, dagger, kwok, grafana-agent-operator, sigstore-scaffolding, falcosidekick, sops, kaniko, conftest, step, k8sgpt, tflint, certificate-transparency, rqlite, step-ca,...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, argocd-image-updater, spark-operator, nodetaint, local-static-provisioner, cri-tools, kubeflow-pipelines, ip-masq-agent, aws-efs-csi-driver, kubernetes-dns-node-cache, k8s-device-plugin...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, argocd-image-updater, spark-operator, nodetaint, kubernetes-csi-driver-nfs, local-static-provisioner, vcluster, yunikorn-k8shim, rancher-fleet, kapp, ip-masq-agent, aws-efs-csi-driver, kubernetes, kubernetes-dns-node-cache,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, chart-testing, docker-credential-gcr, migrate, kapp, ratify, rabbitmq-cluster-operator, kpt, rancher-system-upgrade-controller, cis-operator, kyverno-notation-aws, kubernetes-dashboard, libnvidia-container, hubble,...

Exploit for CVE-2026-21008

--- CVE-2026-21008 – Kubernetes Service Account Token Mounte...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...