Nodes can bypass dynamic resource allocation authorization checks

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L - Low 2.7 A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2024-55549 DESCRIPTION: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. CWE:CWE-416: Use...

PT-2025-23952

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Envoy side-cars affected versions not specified Description A flaw exists in the Linux kernel related to insufficient validation of extensible ioctls within the pidfs subsystem. This could potential...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.13.3 fixes and container updates

Red Hat Advanced Cluster Management for Kubernetes 2.13.3 General Availability release, with updates to container images and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.5.2 release.

Red Hat Developer Hub 1.5.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.7 security and bug fix update

The Migration Toolkit for Containers MTC 1.8.7 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.9 bug fixes and container updates

Red Hat Advanced Cluster Management for Kubernetes 2.9.9 General Availability release, with updates to container images and bug fixes. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.4.9 security updates and bug fixes

Multicluster Engine for Kubernetes 2.4.9 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

The vulnerability of the CRD AdmissionPolicyGroup component in the Kubernetes cluster “kubewarden-controller” allows a attacker to gain unauthorized access to modify data or disclose sensitive information.

The vulnerability of the CRD AdmissionPolicyGroup component in the Kubernetes cluster “kubewarden-controller” is related to improper authorization. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to modify data or expose sensitive information...

Sensitive Information Disclosure

github.com/edgelesssys/contrast is vulnerable to information disclosure. The vulnerability is due to improper logging configuration due to secrets being written to stderr and Kubernetes logs when the log level is set to info or debug, which is the default...

CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

Cross-Site Scripting (XSS)

github.com/argoproj/argo-cd is vulnerable to cross-site scripting XSS. The vulnerability is due to improper URL protocol filtering on the repository page, allowing attackers to perform actions such as creating, modifying, and deleting Kubernetes resources via the API...

CVE-2025-22872 affecting package kubernetes for versions less than 1.30.10-7

CVE-2025-22872 affecting package kubernetes for versions less than 1.30.10-7. A patched version of the package is available...

Argo CD allows cross-site scripting on repositories page

Impact This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with...

Contrast workload secrets leak to logs on INFO level

Impact When the Contrast initializer is configured with a CONTRASTLOGLEVEL of info or debug, the workload secret is logged to stderr and written to Kubernetes logs. Since info is the default setting, this affects all Contrast installations that don't customize their initializers' log level. The...

GHSA-H5F8-CRRQ-4PW8 Contrast workload secrets leak to logs on INFO level

Impact When the Contrast initializer is configured with a CONTRASTLOGLEVEL of info or debug, the workload secret is logged to stderr and written to Kubernetes logs. Since info is the default setting, this affects all Contrast installations that don't customize their initializers' log level. The...

PT-2026-99446

Name of the Vulnerable Software and Affected Versions Contrast Edgeless Systems versions prior to 1.8.1 Description The Contrast initializer logs the workload secret to stderr, which directs the information into Kubernetes logs. This occurs when the CONTRAST LOG LEVEL variable is set to info or...

The vulnerability of the Kubernetes Helm package manager, related to buffer overflows in the stack, allows a attacker to cause a service failure.

The vulnerability of the package manager for Kubernetes Helm is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to trigger a service failure...

CVE-2025-5198

A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting XSS if the script code is included in a small subset of table cells. The only known potential exploit is if the script is included in the name of a Kubernetes “Role” object that is applied to a secured cluster. This obje...