GO-2026-6609 vulnerabilities

Vulnerabilities for packages: rancher-agent, atlantis, aactl, grafana-alloy, loki, argo-workflows, k8s-device-plugin, karpenter, flux, opencost, kube-arangodb, hubble-ui, spire-server, kyverno-policy-reporter-ui, step, rancher, headlamp, grafana, kubernetes, temporal-ui-server, yunikorn-web, k6,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: rancher-agent, atlantis, aactl, grafana-alloy, loki, argo-workflows, k8s-device-plugin, karpenter, flux, opencost, kube-arangodb, hubble-ui, spire-server, kyverno-policy-reporter-ui, step, rancher, headlamp, grafana, kubernetes, temporal-ui-server, yunikorn-web, k6,...

GO-2026-6506 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

GO-2026-6506 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway, kubernetes-dns-node-cache...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway, kubernetes-dns-node-cache...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, kubernetes-dns-node-cache-fips, k8sgateway, juicefs, eks-distro, kubernetes-dns-node-cache, eks-distro-fips...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

EUVD-2026-63899

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

PT-2026-79360

Name of the Vulnerable Software and Affected Versions JuiceFS affected versions not specified Description The filestore backend in pkg/object/file.go, used for file:// stores and as a common sync destination, fails to verify if the target path remains within the root directory. The pathkey functi...

CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: coredns, rancher-agent, tekton-chains, crossplane-provider-aws-kinesis, argo-workflows, kyverno-notation-aws, kyverno, kubernetes-csi-external-snapshotter, terraform-provider-kubernetes, grpcurl, kuma, cri-tools, rancher, secrets-store-csi-driver-provider-azure,...