CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – تثبيت رمز حساب الخدمة في Kubernetes عبر HostPath كود البرنامج YAML + استغلال Python root@kitploit: vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: - name:...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

PT-2026-84161

Name of the Vulnerable Software and Affected Versions Kyverno versions v1.9.0 through v1.12.7 Description A flaw exists in the policy exception handling when a policy is set to enforce mode and combined with two PolicyExceptions. The system incorrectly allows a less restrictive exception to take...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: longhorn-share-manager-fips, longhorn-manager, azuredisk-csi, rke2-runtime-fips, harvester, rancher-system-agent, azurefile-csi, harvester-fips, eks-distro, cluster-autoscaler-fips, kubernetes-csi-driver-hostpath, azurefile-csi-fips, longhorn-manager-fips,...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, ip-masq-agent, aws-efs-csi-driver, rancher-webhook, aws-ebs-csi-driver, kubeflow-pipelines, argocd-image-updater-fips, kubernetes-csi-driver-hostpath, nodetaint, kubernetes, spark-operator, kubernetes-dns-node-cache, local-static-provisioner,...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: grafana-agent-operator, tflint, grafana-mimir, kubernetes-csi-external-provisioner, kaniko, spire-server, fulcio, dbmate, sigstore-scaffolding, cert-manager-cmctl, falcosidekick, k8sgpt-operator, terraform-docs, ksops, gomplate, spegel, kargo, melange, terragrunt,...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, cri-tools, kubernetes-dns-node-cache, kubernetes-csi-driver-hostpath, k8s-device-plugin, spark-operator, ip-masq-agent, argocd-image-updater, aws-efs-csi-driver, kubeflow-pipelines, nodetaint...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: kapp, emissary, local-static-provisioner, kubernetes-csi-driver-nfs, rancher-webhook, spark-operator, kubernetes, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, ip-masq-agent, argocd-image-updater, aws-efs-csi-driver, vcluster, argo-rollouts,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-set-status, lazydocker, oauth2-proxy, envconsul, tkn, wire-go, glow, headlamp, kuberlr, ratify, cloud-sql-proxy, nodetaint, migrate, step-kms-plugin, controller-gen, nri-f5, terraform, ini-file, nri-redis, trivy, rabbitmq-cluster-operator, portieris, conftest,...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

Local Path Provisioner Vulnerable to HelperPod Template Injection

Impact A malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC...

Bypassing Kyverno Policies via Double Policy Exceptions

Summary If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second. Details The following policy was applied: yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata:...

EUVD-2023-0865

Malicious code in bioql PyPI...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Linux Distros Unpatched Vulnerability : CVE-2021-43816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since...