CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – Kubernetes Service Account Token Mounted in HostPath Program Code YAML + Python exploit vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: - name: app image:...

PT-2026-108894

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's kubernetes.yaml and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and...

CVE-2026-76061 Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...

CVE-2026-76061

A flaw was found in CRI-O's bindmountprefix handling. When configured with a non-empty bindmountprefix, a malicious container or local attacker could use a Container Runtime Interface CRI hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outsi...

BIT-KYVERNO-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

PT-2026-98995

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

A flaw was found in Kyverno. This policy exception handling flaw allows a remote attacker to bypass security policies. By crafting a resource name that matches a less restrictive exception pattern, an attacker can circumvent policies, such as those blocking hostPath volumes, leading to unauthoriz...

SUSE CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200 Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

CVE-2026-84200: Improper Access Control

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: eks-distro, longhorn-manager, longhorn-share-manager-fips, cluster-autoscaler-fips, harvester, azurefile-csi-fips, longhorn-manager-fips, rancher-system-agent, harvester-fips, rke2-runtime-fips, kubernetes-csi-driver-hostpath, azurefile-csi, argo-cd-fips,...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, argocd-image-updater-fips, rancher-webhook-fips, aws-efs-csi-driver, nodetaint, aws-efs-csi-driver-fips, ip-masq-agent, aws-ebs-csi-driver, spark-operator, argocd-image-updater, kubeflow-pipelines, rancher-webhook,...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, kubernetes-csi-driver-hostpath...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dex, k3d, kwok, conftest, kaniko, melange, ferretdb, spegel, grpc-health-probe, fulcio, terraform-provider-google, k8sgpt-operator, grafana-mimir, step-ca, zarf, guac, gomplate, restic, certificate-transparency, smarter-device-manager, ksops, pulumi-language-dotnet,...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, k8s-device-plugin, aws-efs-csi-driver, cri-tools, kubernetes-dns-node-cache, kubeflow-pipelines, local-static-provisioner, ip-masq-agent, nodetaint, kubernetes-csi-driver-hostpath, spark-operator...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: emissary, argocd-image-updater, rancher-fleet, kubernetes-csi-driver-nfs, aws-efs-csi-driver, kubernetes, kapp, kubernetes-dns-node-cache, argo-rollouts, yunikorn-k8shim, local-static-provisioner, ip-masq-agent, vcluster, nodetaint, kubernetes-csi-driver-hostpath,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: emissary, k3d, nova, conftest, terraform-provider-azapi, fulcio, ipfs-cluster, gobuster, amazon-cloudwatch-agent-operator, aactl, mockgen, kyverno-notation-aws, docker-cli, cerbos, libnvidia-container, aws-privateca-issuer, kubernetes-dashboard-web, kubeflow-katib,...

Exploit for CVE-2026-21008

--- CVE-2026-21008 – Kubernetes Service Account Token Mounte...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through