CVE-2025-66623

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...

CVE-2025-66623 Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: nrdot-collector-k8s, sealed-secrets, fleet-server, kserve-rest-proxy, langfuse-fips, crossplane-fips, docker-credential-gcr-fips, aws-flb-cloudwatch-fips, go-fips, sops, juicefs, azuredisk-csi-fips, kube-metrics-adapter-fips, opentelemetry-operator, flannel-cni-plugi...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: nrdot-collector-k8s, sealed-secrets, fleet-server, kserve-rest-proxy, langfuse-fips, crossplane-fips, docker-credential-gcr-fips, aws-flb-cloudwatch-fips, go-fips, sops, juicefs, azuredisk-csi-fips, kube-metrics-adapter-fips, opentelemetry-operator, flannel-cni-plugi...

PT-2025-49308

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.49.0 Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. Versions from 0.47.0 up to 0.49.0 incorrectly create a Kubernetes Role. This role grants Apache Kafka Connect and...

Strimzi 安全漏洞

Strimzi is a program from the Strimzi open source that allows running Apache Kafka clusters on Kubernetes in various deployment configurations. A security vulnerability exists in Strimzi versions 0.47.0 through prior to 0.49.1, which stems from the creation of incorrect Kubernetes roles and could...

CVE-2025-31133 affecting package kubernetes for versions less than 1.30.10-15

CVE-2025-31133 affecting package kubernetes for versions less than 1.30.10-15. A patched version of the package is available...

CVE-2025-52565 affecting package kubernetes for versions less than 1.30.10-15

CVE-2025-52565 affecting package kubernetes for versions less than 1.30.10-15. A patched version of the package is available...

Moderate: Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Submariner v0.22 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: rancher-fleet, sops, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, helm-operator, rancher-system-upgrade-controller, nova, kubernetes-dashboard, k3s, influx, falco-exporter, hcloud, nats-top, k8ssandra-client, pulumi-kubernetes-operator,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: rancher-fleet, sops, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, helm-operator, rancher-system-upgrade-controller, nova, kubernetes-dashboard, k3s, influx, falco-exporter, hcloud, nats-top, k8ssandra-client, pulumi-kubernetes-operator,...

AZL-71543 CVE-2025-65637 affecting package kubernetes for versions less than 1.30.10-18

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

AZL-71617 CVE-2025-65637 affecting package kubernetes for versions less than 1.28.4-21

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

PT-2025-49178

Name of the Vulnerable Software and Affected Versions kube-controller-manager affected versions not specified Description An issue exists in kube-controller-manager when utilizing the in-tree Portworx StorageClass, allowing authorized users to potentially leak information from unprotected endpoin...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update

Red Hat Advanced Cluster Management for Kubernetes 2.12 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.12 images Red Hat Advanced Cluster Management for Kubernetes provides...

Moderate: Red Hat Security Advisory: multicluster engine for Kubernetes v2.7.7 security update

The multicluster engine for Kubernetes 2.7 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.7 images The multicluster engine for Kubernetes provides the foundational components that are...

CVE-2025-66404

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string...

@toolsdk.ai/registry (1.0.83) potentially affected by CVE-2025-66404 via mcp-server-kubernetes (2.4.3)

mcp-server-kubernetes NPM version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-server-kubernetes and may be impacted: - @toolsdk.ai/registry 1.0.83 Source cves: CVE-2025-66404 Source advisory: SNYK:JS-MCPSERVERKUBERNETES-14176095...

Arbitrary Command Injection

Overview mcp-server-kubernetes is a MCP server for interacting with Kubernetes clusters via kubectl Affected versions of this package are vulnerable to Arbitrary Command Injection via the execinpod tool. An attacker can execute arbitrary commands within Kubernetes pods by supplying crafted input...

mcp-server-kubernetes has potential security issue in exec_in_pod tool

Summary A security issue exists in the execinpod tool of the mcp-server-kubernetes MCP Server. The tool accepts user-provided commands in both array and string formats. When a string format is provided, it is passed directly to shell interpretation sh -c without input validation, allowing shell...