CVE-2026-55769

CloudNativePG (a Kubernetes operator for PostgreSQL) is vulnerable to privilege escalation to superuser in versions prior to 1.28.4 and 1.29.2 . The root cause is that superuser connections in fillDefaultParameters (pkg/management/postgres/pool/profiles.go) did not pin search_path. An attacker wi...

CVE-2026-55765

CloudNativePG (a Kubernetes-based PostgreSQL management platform) prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword and appendPasswordOption. When pg_stat_statements was preloaded with track_utility enabled, an untru...

EUVD-2026-63685

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-55765 CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-66787 Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

GO-2026-6238 vulnerabilities

Vulnerabilities for packages: kubescape-server, virt-handler, beats-fips, gitaly, falcoctl, docker, runc, splunk-otel-collector-fips, delve, nerdctl, elastic-agent, cosmo-router-fips, opentelemetry-ebpf-instrumentation-fips, virt-handler-fips, k3s, prometheus, nerdctl-fips, kubescape-server-fips,...

CVE-2026-73499 vulnerabilities

Vulnerabilities for packages: kine, dapr...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, timoni, crossplane-provider-aws-eks, crossplane-provider-azure-authorization, grafana, crossplane-provider-azure-managedidentity, crossplane-provider-azure-sql, gitness, crossplane-provider-aws-s3, crossplane-provider-aws-lambda,...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, timoni, crossplane-provider-aws-eks, crossplane-provider-azure-authorization, grafana, crossplane-provider-azure-managedidentity, crossplane-provider-azure-sql, gitness, crossplane-provider-aws-s3, crossplane-provider-aws-lambda,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cluster-api-gcp-controller, crossplane, cluster-api, kuma, external-secrets-operator, calico, kube-rbac-proxy, grafana, metallb, kubernetes-csi-external-health-monitor, cloud-provider-aws, azure-service-operator, cert-manager-istio-csr,...

CVE-2026-73500 affecting package kubernetes for versions less than 1.30.10-28

CVE-2026-73500 affecting package kubernetes for versions less than 1.30.10-28. A patched version of the package is available...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update

Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update

Red Hat Advanced Cluster Management for Kubernetes v2.16 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

CVE-2026-18544 Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

GHSA-6VCH-Q96H-7GC3 vulnerabilities

Vulnerabilities for packages: kine, kots, minio, commercial-grafana, kubernetes, cilium, kube-conformance, multicluster-controlplane-fips, cert-manager, reports-server, cilium-cli, loki, external-dns, dapr, rancher-support-bundle-kit, multicluster-controlplane, milvus, hubble, kyverno...

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...