209 matches found
mesh-kridik
mesh-kridik 增强您的 Kubernetes 服务网格安全性！！ mesh-kridik 是一个开源安全检查器，对运行 Istio 服务网格的 Kubernetes 集群执行各种安全检查，并输出安全报告。 安全检查测试完整实现了 istio 安全最佳实践。 在运行 Istio 服务网格的 Kubernetes 集群上执行安全检查，并利用 OPA（Open Policy Agent）强制执行安全规则，输出审计报告包括： 安全问题根因以及建议的修复措施。 要求 安装 快速开始 Istio 安全检查 用户插件使用 支持的规范 贡献 要求 Go 1.16+ jq istio 安装...
cluster-image-scanner
ClusterImageScanner 在生產環境中發現漏洞和容器镜像配置错误。 简介 ClusterImageScanner 能检测 Kubernetes 集群中的镜像，并根据各种安全测试提供快速反馈。建议在生产环境中运行 ClusterImageScanner，以便在安全漏洞产生实际影响时获得及时反馈。 由于 ClusterImageScanner 本身是运行在 Kubernetes 集群中的服务，你可以复用现有的部署流程。 概述 下图提供了概述： 执行以下步骤。 1. 镜像收集器，顾名思义，从容器环境（如 Kubernetes 集群）中收集不同的镜像。收集器创建一个 JSON...
permission-manager
Permission manager Welcome to the Permission Manager! 🎉 🎉 Permission Manager is an application developed by SIGHUP that enables a super-easy and user-friendly RBAC management for Kubernetes. If you are looking for a simple and intuitive way of managing your users within a Kubernetes cluster, this...
kube-alien
Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...
kubetcd
Kubetcd Wrapper de https://github.com/jpbetz/auger. Automatiza el despliegue de pods escribiendo directamente en etcd. Incluye múltiples funciones para la post-explotación de etcds comprometidos. Descargo de responsabilidad !WARNING Esto es una PoC, no lo uses en un entorno de producción. Escribi...
Cluster-Chaos-Exploiting-CVE-2025-59359-for-Kubernetes-Takeover
Cluster-Chaos-Explotando-CVE-2025-59359-para-la-Toma-de-Kubernetes Un recorrido forense práctico de CVE-2025-59359, una falla crítica de inyección de comandos del sistema operativo en Chaos-Mesh. Aprenda cómo los atacantes secuestran clústeres de Kubernetes a través de mutaciones de GraphQL, y có...
CVE-2026-54246
CVE-2026-54246 affects the routesrv component of Skipper (Zalando's HTTP router and reverse proxy). Prior to version 0.27.13 , routesrv serves cluster-wide control-plane data—Ingress/RouteGroup backend URLs, filter-chain and OAuth/OIDC path details, and Redis/Valkey shard addresses—over plain HTT...
EUVD-2026-78061
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/zone, /swarm/redis/shards, and /swarm/valkey/shards. The handlers registered in...
EUVD-2026-74894
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
CVE-2026-15140
CVE-2026-15140 is a privilege-escalation vulnerability in the Portworx Operator when deployed on Red Hat OpenShift (OCP) . During the initial provisioning of a Portworx storage cluster, under specific conditions, a user with only namespace-scoped permissions can cause the operator to grant broade...
PT-2026-88964
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
peirates v1.1.31
Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...
CVE-2026-62440
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
EUVD-2026-63835
Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...
PT-2026-79328
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Access Control in the Kubernetes Service CKS plugin allows cross-tenant manipulation of the Kubernetes cluster during the process of adding and removing nodes...
GO-2023-1850 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2025-4102 vulnerabilities
Vulnerabilities for packages: docker-machine-driver-harvester...
GO-2023-1992 vulnerabilities
Vulnerabilities for packages: k3d...