GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, mongodb-kubernetes-operator-fips, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, oras-fips, nri-postgresql-fips, sigstore-scaffolding-fips,...

CVE-2026-33811 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, knative-operator-fips, azure-aad-pod-identity-mic, cloudbeat, crossplane-provider-aws-kafkaconnect...

GHSA-QC64-M6C2-V4X7 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, mongodb-kubernetes-operator-fips, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, oras-fips, nri-postgresql-fips, sigstore-scaffolding-fips,...

CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, mongodb-kubernetes-operator-fips, rke2-runtime-fips, crossplane-provider-aws-memorydb-fips, nginx-kubernetes-ingress, oras-fips, nri-postgresql-fips, yunikorn-web-fips,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager-fips, mongodb-kubernetes-operator-fips, knative-operator-fips, mlrun-log-collector-fips, step-ca, chainctl-fips, nginx-kubernetes-ingress-fips, monstache, ocm-cli-fips, crossplane-provider-aws-elasticsearch-fips, docker-credential-acr-env-fips...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017390)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017390 advisory. The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the ConfigMap-backed provider in the Sync Service not performing authorization checks...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-016823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016823 advisory. A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the fact that the workflow executor recorded all workpiece repository credentials in...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

Dirty-Frag-Kubernetes-PoC

Dirty Frag CVE-2026-43284 — Kubernetes Container Escape PoC...

📄 Apache Airflow Databricks Provider Certificate Verification Bypass

The Apache Airflow Databricks Provider package disables TLS certificate verification when communicating with the Kubernetes API server during federated token exchange. Both the synchronous and asynchronous code paths use verify=False / ssl=False, allowing any attacker with network access within t...

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...

CVE-2026-42880

CVE-2026-42880 (Argo CD) : A missing authorization/data-masking gap in Argo CD’s ServerSideDiff endpoint allows an attacker with read-only access to extract plaintext Secret data from etcd via the Kubernetes API server’s Server-Side Apply dry-run. Affected versions are 3.2.0–3.2.10 and 3.3.0–3.3....

GHSA-8MC6-XJPR-H98X Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

Summary The fetchPeerConnectInfo function in internal/service/connect/connect.go:214-239 uses httpUtil.SendRequest no SSRF protection instead of SendSafeRequest which has ValidatePublicHTTPURL with private IP blocking. This allows authenticated users to make the server request arbitrary URLs...

Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

Summary The fetchPeerConnectInfo function in internal/service/connect/connect.go:214-239 uses httpUtil.SendRequest no SSRF protection instead of SendSafeRequest which has ValidatePublicHTTPURL with private IP blocking. This allows authenticated users to make the server request arbitrary URLs...

AZL-86424 CVE-2026-33814 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-5

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...