CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Real-Browser 监控中的不当 URL 处理导致本地文件包含 LFI 摘要 一个不当的 URL 处理漏洞 允许攻击者通过利用 file:/// 协议访问服务器上的敏感本地文件。该漏洞通过 "real-browser" 请求类型触发，该类型会截取攻击者提供的 URL 的屏幕截图。通过提供本地文件路径（例如 file:///etc/passwd），攻击者可以读取服务器上的敏感数据。 详细信息 该漏洞的产生原因是系统未对 URL 字段的用户输入进行适当的验证或清理。具体如下： 1. URL...

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

CVE-2026-52724

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724

Kuma is an Envoy-based service mesh. In Universal mode , when kuma-dp connects to an HTTPS control plane without a CA certificate (--ca-cert-file unset and KUMA_CONTROL_PLANE_CA_CERT unset), TLS peer verification is disabled . An on-path attacker can intercept the dataplane authentication token, ...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-attacher, kyverno-notation-aws, kots, apisix-ingress-controller, kuma, rancher-system-agent, opentelemetry-operator, tetragon, cloud-provider-aws, cluster-api-ipam-provider-in-cluster, grafana, openfga, rancher, cluster-autoscaler,...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: hubble-ui, cilium, k3s, containerd, runc, kuma, kubescape-operator, falcoctl, nerdctl, witness, docker, splunk-otel-collector, delve, kubescape, hubble, vitess, gitaly...

GHSA-XHGW-QWWF-PG32 vulnerabilities

Vulnerabilities for packages: hubble-ui, cilium, k3s, containerd, runc, kuma, kubescape-operator, falcoctl, nerdctl, witness, docker, splunk-otel-collector, delve, kubescape, hubble, vitess, gitaly...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

PT-2026-76636

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-source-controller, chartmuseum, helm-docs, k8sgpt, envoy-gateway, teleport, cluster-api-helm-controller, chart-testing-fips, flux-helm-controller-fips, zarf, cert-manager-cmctl, chart-testing, flux, rancher-helm, k8ssandra-client, k9s,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-source-controller, chartmuseum, helm-docs, cluster-api-helm-controller-fips, cluster-api-helm-controller, chart-testing-fips, flux-helm-controller-fips, zarf, cert-manager-cmctl, chart-testing, flux, rancher-helm, k8ssandra-client, k9s,...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: helm-exporter, headlamp-fips, kubescape-server, cert-manager-cmctl-fips, helm, flux-source-controller, chartmuseum, helm-docs, helm-mapkubeapis, cluster-api-helm-controller-fips, envoy-gateway, teleport, cluster-api-helm-controller, chart-testing-fips, kube-arangodb,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, flux-source-controller, chartmuseum, helm-docs, cluster-api-helm-controller-fips, cluster-api-helm-controller, chart-testing-fips, flux-helm-controller-fips, zarf, cert-manager-cmctl, chart-testing, flux, rancher-helm, k8ssandra-client, k9s,...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: containerd-fips, amazon-k8s-cni-fips, buildkitd-fips, k3s, nerdctl-fips, docker, rootlesskit-fips, azure-ipam, containerd, nerdctl, rootlesskit, datadog-agent-fips, flannel, multus-cni-fips, multus-cni, flannel-fips, calico, istio, buildah, istio-fips, rke2-runtime,...