kube-bench

kube-bench は、CIS Kubernetes Benchmark に文書化されたチェックを実行することで、Kubernetes が安全にデプロイされているかどうかをチェックするツールです。 テストは YAML ファイルで設定されるため、テスト仕様の進化に合わせてこのツールを簡単に更新できます。 Trivy および Trivy Operator の一部としての CIS スキャン Trivy は、オールインワンのクラウドネイティブセキュリティスキャナーであり、Kubernetes Operator としてクラスター内にデプロイできます。 Trivy CLI と Trivy...

kube-bench

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: fulcio, cloud-provider-gcp-cloud-controller-manager, docker-cli-buildx, gobump, argo-events, buildkitd, lazydocker, aws-application-networking-k8s, clickhouse-operator, kubernetes-csi-driver-hostpath, mongo-tools, nri-f5, pluto, portieris, nginx-prometheus-exporter,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: fulcio, argo-events, kubevela, pluto, crossplane-provider-aws-rds, thanos, k3s, kube-vip, tekton-chains, gcsfuse, aws-privateca-issuer, tw, flannel, velero-plugin-for-microsoft-azure, kube-rbac-proxy, kubewatch, nri-discovery-kubernetes, x509-certificate-exporter,...

CLEANSTART-2026-VV16787 Security fixes in kube-bench 0.15.0-r1

Package kube-bench version 0.15.0-r1 fixes 23 vulnerabilities: CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506, CVE-2026-25680...

CLEANSTART-2026-HC35488 Security fixes in kube-bench-fips 0.14.1-r0

Package kube-bench-fips version 0.14.1-r0 fixes 4 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: wave-fips, verticadb-operator, sonobuoy, datadog-agent-fips, volsync, dfc, controller-gen, kube-rbac-proxy-fips, gcp-compute-persistent-disk-csi-driver, victoriametrics-operator-fips, cadence, kafkaexporter-fips, rancher-webhook, redis-operator,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: volsync, fq, velero-plugin-for-aws, rancher-fleet, bazelisk, k8s-driver-manager, thanos-operator, gostatsd, dcgm-exporter, dcgm-exporter-fips, knative-operator, mods, apache-beam-python-3.12-sdk, temporal, terraform-provider-azuread-fips,...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: blob-csi, grafana-alloy, controller-gen, nri-apache, wal-g, gcp-compute-persistent-disk-csi-driver, zot, amazon-cloudwatch-agent-operator, kubeflow-katib, docker-credential-gcr, fzf, k8sgpt, gcsfuse, prometheus, k8sgateway, docker-cli-buildx, thanos-operator, bom,...

PT-2025-33645 · Undefined · Undefined

🚨 URGENT: Kubernetes admins must patch CVE-2025-02383 SUSE-2025-02383-2 ✅ Affects: kube-apiserver v1.26.x ✅ Risk: Moderate-severity RBAC bypass. ✅ Fix: Apply SUSE patches NOW + validate with kube-bench. Read more: 👉 https://t.co/VRCE9nkHn3 https://t.co/ukAF3LWe56...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: wave-fips, verticadb-operator, kubernetes-release, fq, gofumpt, gcp-compute-persistent-disk-csi-driver, kube-metrics-adapter, kubelet-csr-approver-fips, kubeflow-katib, node-feature-discovery-fips, rancher-fleet, crossplane-provider-azure, bazelisk, loki, prometheus,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, wazero, nri-prometheus, secrets-store-csi-driver-provider-gcp, kwok, protoc-gen-go-grpc, up, buildkitd, configmap-reload, nri-f5, mongo-tools, kubevela, kubernetes-dns-node-cache, nri-mongodb, vexctl, kube-bench, metallb, stakater-reloader, thanos...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: flannel-cni-plugin, wazero, nri-prometheus, secrets-store-csi-driver-provider-gcp, kwok, protoc-gen-go-grpc, up, buildkitd, configmap-reload, nri-f5, mongo-tools, kubevela, kubernetes-dns-node-cache, nri-mongodb, vexctl, kube-bench, metallb, stakater-reloader, thanos...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: wave-fips, sonobuoy, fq, velero-plugin-for-aws, controller-gen, minify, kube-rbac-proxy-fips, kube-state-metrics-fips, kubeflow-katib, crossplane-provider-azure, bazelisk, loki, prometheus-node-exporter-fips, k8ssandra-operator-fips, prometheus, thanos-operator, croc...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step-ca, spicedb, temporal-server, caddy-fips, amass, kots, step, kube-bench-fips, kube-bench, k3s, trillian-fips, wavefront-collector-for-kubernetes, falcosidekick-fips, caddy, ferretdb, src, argo-workflows-fips, trillian, temporal-server-fips, kine, argo-workflows...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step, ferretdb, caddy, step-ca, argo-workflows, kube-bench, kots, k3s, amass, src, temporal-server, trillian, spicedb, kine...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: fulcio, terraform-provider-aws, crossplane-provider-azure-storage, nri-prometheus, secrets-store-csi-driver-provider-gcp, kwok, grafana-agent-operator, crossplane-provider-aws-sns, protoc-gen-go-grpc, up, buildkitd, configmap-reload, kubernetes-csi-driver-hostpath,...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step, ferretdb, caddy, step-ca, argo-workflows, kube-bench, kots, k3s, amass, src, temporal-server, trillian, spicedb, kine...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step-ca, spicedb, temporal-server, caddy-fips, amass, kots, step, kube-bench-fips, kube-bench, k3s, trillian-fips, wavefront-collector-for-kubernetes, falcosidekick-fips, caddy, ferretdb, src, argo-workflows-fips, trillian, temporal-server-fips, kine, argo-workflows...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: step-ca, spicedb, temporal-server, caddy-fips, amass, kots, step, kube-bench-fips, kube-bench, k3s, trillian-fips, wavefront-collector-for-kubernetes, falcosidekick-fips, caddy, ferretdb, src, argo-workflows-fips, trillian, temporal-server-fips, kine, argo-workflows...