kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the...

kube-linter

Kubernetes 静态分析 什么是 KubeLinter？ KubeLinter 分析 Kubernetes YAML 文件、Helm Chart 和 Kustomize 清单，并根据各种最佳实践（重点关注生产就绪性和安全性）对其进行检查。 KubeLinter 运行合理的默认检查，旨在为你提供有关 Kubernetes YAML 文件、Helm Chart 和 Kustomize 清单的有用信息。这有助于团队尽早且频繁地检查安全错误配置和 DevOps 最佳实践。一些常见的示例包括以非 root 用户运行容器、强制最小权限原则，以及仅将敏感信息存储在 Secret 中。...

EUVD-2026-43087

Spinnaker: Improper yaml processing on kustomize bake operations...

GHSA-P68J-Q7HF-3QCP Spinnaker: Improper yaml processing on kustomize bake operations

Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. Workarounds Disable...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cluster-api-gcp-controller, crossplane, cluster-api, kuma, external-secrets-operator, calico, kube-rbac-proxy, grafana, metallb, kubernetes-csi-external-health-monitor, cloud-provider-aws, azure-service-operator, cert-manager-istio-csr,...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-76229

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: fairwinds-gemini-fips, crossplane-provider-family-gcp-config, addon-resizer, grafana-alloy-fips, bank-vaults-vault-operator-fips, crossplane-provider-aws-signer-fips, k8s-metacollector, crossplane-provider-aws-appautoscaling-fips, crossplane-provider-aws-rds-fips,...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma-fips, telegraf, karma, kyverno, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, zitadel, fluxcd-kustomize-mutating-webhook, cosmo-router...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma-fips, telegraf, karma, kyverno, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, zitadel, fluxcd-kustomize-mutating-webhook, cosmo-router...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma-fips, telegraf, karma, kyverno, fluxcd-kustomize-mutating-webhook-fips, cosmo-router-fips, zitadel, fluxcd-kustomize-mutating-webhook, cosmo-router...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: kots, pulumi-language-java, zot, scorecard, pulumi-language-yaml, src-fingerprint, nuclei, pulumi, gitness, pulumi-kubernetes-operator, pulumi-language-dotnet, go-licenses, bom, gomplate, gitsign, flux-kustomize-controller, kubevela, goreleaser, apko...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, age, restic-fips, kyverno-policy-reporter-ui, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, grpcurl-fips, argo-rollouts-fips, external-secrets-operator-fips, gobuster, pombump,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, age, restic-fips, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, grpcurl-fips, argo-rollouts-fips, external-secrets-operator-fips, gobuster, sriov-network-device-plugin,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, age, restic-fips, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, grpcurl-fips, argo-rollouts-fips, external-secrets-operator-fips, gobuster, sriov-network-device-plugin,...