CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: external-dns, containerd, runc, kubo, minio, kube-fluentd-operator, kyverno, kaf, k3s, loki, kine, telegraf, kubernetes-dashboard, aactl, flux, helm, cert-manager...

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-16745

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...

EUVD-2026-47972

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: kubo, k3s, coder-fips, minio, kube-fluentd-operator, telegraf, kaf, opentelemetry-collector-k8s, cert-manager, kubo-fips, containerd, runc, reports-server, terraform, tigera-operator, azure-aad-pod-identity-mic, external-dns, prometheus-elasticsearch-exporter,...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: kubo, k3s, coder-fips, minio, kube-fluentd-operator, telegraf, kaf, opentelemetry-collector-k8s, cert-manager, kubo-fips, containerd, runc, reports-server, terraform, tigera-operator, azure-aad-pod-identity-mic, external-dns, prometheus-elasticsearch-exporter,...

Kubernetes Dashboard <1.10.1 - Authentication Bypass

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

KubeView <=0.1.31 - Information Disclosure

KubeView through 0.1.31 is susceptible to information disclosure. An attacker can obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication and retrieves certificate files that can be used for authentication as kube-admin. An attacker can thereby possib...

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...

PT-2026-64145

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: chronograf-fips, jitsucom-bulker, k8s-image-swapper-fips, crossplane-provider-aws-detective, crossplane-function-patch-and-transform, cilium-fips, mc-fips, crossplane-provider-aws-iot, minio-fips, gomplate-fips, k3d, kuma, terragrunt-fips,...

CVE-2026-65602 Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references the allowlist was only enforced for HTTP serversTransport references. A low-privileged Kubernetes user in a namespace not listed in...

CVE-2026-65601 Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route auth...

EUVD-2026-46807

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen...

EUVD-2026-46806

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen...

EUVD-2026-46811

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where TimesTen...

EUVD-2026-46809

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where TimesTen...

EUVD-2026-46805

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen...

EUVD-2026-46810

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen...