GO-2026-4977 vulnerabilities

Vulnerabilities for packages: nfpm, tkn, trino, argo-cd, cloud-provider-azure, helm, azure-service-operator, metrics-server, zot, datadog-agent, istio, nats, kubernetes-csi-external-attacher, k3s, redka, prometheus-operator, kube-fluentd-operator, prometheus, ko, kubernetes, undock, crossplane,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: sops, nri-discovery-kubernetes, go-md2man, cortex, gke-gcloud-auth-plugin, nsc, oras, kubernetes-dashboard-metrics-scraper, go-bindata, wait-for-port, grpcurl, k3d, dgraph, helm-push, metrics-server, ip-masq-agent, sonobuoy, cass-operator, nats, gosu,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, tfsec, bom, bento, gitness, kubernetes-dns-node-cache, terraform, flux-notification-controller, helm-set-status, helm, kubernetes-dashboard, conftest, mattermost, vale, helm-operator, xeol, flux-kustomize-controller, aactl, croc,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tkn, kubescape, neuvector-sigstore-interface, vexctl, trivy-operator, teleport, tekton-chains, falcoctl, zot, kyverno-notation-aws, aactl, cosign, tflint, zarf, trivy, goreleaser, gitsign, gh, ko, skaffold, ratify, buildkitd, slsa-verifier,...

GO-2026-4918 vulnerabilities

Vulnerabilities for packages: nfpm, tkn, addon-resizer, cilium-certgen, dagger, nri-mssql, argo-cd, newrelic-nri-kube-events, external-secrets-operator, metrics-server, zot, istio, wal-g, aws-application-networking-k8s, kubo, argocd-image-updater, kyverno-policy-reporter-ui,...

GO-2023-2383 vulnerabilities

Vulnerabilities for packages: sops, nri-discovery-kubernetes, go-md2man, cortex, gke-gcloud-auth-plugin, nsc, oras, kubernetes-dashboard-metrics-scraper, go-bindata, wait-for-port, grpcurl, k3d, dgraph, helm-push, metrics-server, ip-masq-agent, sonobuoy, cass-operator, nats, gosu,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: sops, spqr, tfsec, temporal-ui-server, gogatekeeper, crossplane-provider-aws-lambda, neuvector-sigstore-interface, local-static-provisioner, spire-controller-manager, terraform, flux-notification-controller, kuma, helm-set-status, kustomize, helm,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tkn, opa, delve, neuvector-sigstore-interface, polaris, spire-controller-manager, portieris, terraform, regclient, helm-set-status, dgraph, azure-service-operator, wire-go, helm-push, rabbitmq-messaging-topology-operator, zot, controller-gen, wal-g,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: overmind, rekor, sqlexporter, nri-kafka, opa, opentelemetry-collector, dagger, nri-mssql, newrelic-nri-kube-events, metrics-server, glab, rabbitmq-messaging-topology-operator, zot, op-geth, kubo, aws-nuke, argocd-image-updater, docker, docker-cli-buildx, undock,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: sops, distribution, flux-source-controller, rekor, rook, seaweedfs, tkn, kaniko, sqlexporter, velero-plugin-for-microsoft-azure, opentelemetry-collector, vexctl, terraform, flux-notification-controller, dgraph, glab, zot, wal-g, op-geth, terraform-provider-azurerm,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: flux-source-controller, tkn, kaniko, flux-image-reflector-controller, kubescape, argo-rollouts, vexctl, actions-runner-controller, terraform, flux-notification-controller, secrets-store-csi-driver-provider-azure, grafana-alloy, bank-vaults, tekton-chains, kots,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sops, flux-image-automation-controller, flux-source-controller, rekor, rook, tkn, flux-image-reflector-controller, opentelemetry-collector, kubescape, neuvector-sigstore-interface, vexctl, actions-runner-controller, pulumi, flux, flux-notification-controller,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: sops, distribution, flux-source-controller, rekor, rook, seaweedfs, tkn, kaniko, ollama, nri-kafka, spqr, sqlexporter, opentelemetry-collector, mkcert, crossplane-provider-aws-lambda, syft, neuvector-sigstore-interface, temporal-ui-server, local-static-provisioner,...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73842

OpenChoreo OpenKubernetes platform vulnerability CVE-2026-73842 affects cluster-gateway internal proxy. Before versions 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certifica...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73667

OpenChoreo is affected: CVE-2026-73667 impacts the Workflow Plane templates in samples/getting-started/workflow-templates/ before versions 1.0.4, 1.1.4, and 1.2.0-rc.2. The root cause is interpolating developer-controlled workflow parameters into shell program text executed via sh -c instead of p...