CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063

The CVE-2026-15063 affects the gorch service in the trustyai-service-operator. The issue is that, even with authentication enabled, gorch exposes unproxied orchestrator and detector metrics ports, reachable from any pod on the cluster network. This bypasses kube-rbac-proxy authentication, enablin...

CVE-2026-15063 Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, pulumi, crossplane-provider-aws-cloudwatchlogs, pulumi-language-java, crossplane-provider-aws-kinesis, caddy, kube-logging-operator, zarf, gitlab-pages, pluto, pulumi-language-dotnet, k3s, crossplane-provider-aws-rds, apko,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: terraform-provider-aws, crossplane-provider-aws-cloudwatchlogs, timoni, crossplane-provider-aws-memorydb, datadog-agent, emissary, crossplane-provider-aws-kinesis-fips, step-issuer-fips, crossplane-provider-aws-servicediscovery, gitlab-runner, terraform-provider-acme...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: terraform-provider-aws, crossplane-provider-aws-cloudwatchlogs, timoni, crossplane-provider-aws-memorydb, datadog-agent, emissary, crossplane-provider-aws-kinesis-fips, step-issuer-fips, crossplane-provider-aws-servicediscovery, gitlab-runner, terraform-provider-acme...

CLEANSTART-2026-BH03809 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the kube-rbac-proxy-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-UJ17204 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the kube-rbac-proxy-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

EUVD-2019-13441

Malware in sbrugna...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter-fips, custom-pod-autoscaler-fips, kubevela-fips, s5cmd, authservice, eks-distro-fips, kube-conformance, addon-resizer-fips, flux-helm-controller, undock, external-dns-fips, cargobump, terraform-provider-kubernetes-fips, step-ca, rclone,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, buildkitd, nri-nginx, govulncheck, pulumi, protoc-gen-go-grpc, vault-k8s, actions-runner-controller, aws-efs-csi-driver, lazygit, pulumi-language-java, dgraph, aws-load-balancer-controller, kine, nri-memcached, nuclei, kubeflow-pipelines,...

Important: Red Hat Bug Fix Advisory: OpenShift Container Platform 4.6.15 bug fix update

Red Hat OpenShift Container Platform release 4.6.15 is now available with updates to packages and images that fix several bugs. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This...

CVE-2019-3818

The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the...

CVE-2019-3818

The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the...

CVE-2019-3818

The CVE concerns kube-rbac-proxy (container) used in Red Hat OpenShift Container Platform. Affected: kube-rbac-proxy before version 0.4.1. Issue: TLS configurations are not honored, enabling insecure ciphers and TLS 1.0 usage. Impact: potential exposure of traffic to weak encryption; attacker cou...

Man-in-the-Middle (MitM)

kube-rbac-proxy is vulnerable to man-in-the-middle attack. Insecure ciphers and TLS 1.0 are used to establish an SSL connection between the client and server, which would allow a remote attacker to exploit TLS vulnerabilities and perform man-in-the-middle attacks to sniff traffic containing...

CVE-2019-3818

The kube-rbac-proxy container, as used in Red Hat OpenShift Container Platform, does not honor TLS configurations allowing for the use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption of the...