kube-score

kube-score kube-score is a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient. You can test kube-score out in the browser with the online demo source...

kube-linter

Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...

CLEANSTART-2026-CL42634 Security fix for CVE-2022-3219 applied in: git-lfs 3.7.0-r1, kustomize 5.7.1-r1

CVE-2022-3219 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Remote Code Execution (RCE)

Spinnaker is vulnerable to remote code execution RCE. The vulnerability is due to unsafe processing of YAML tags during Kustomize bake operations, which allows an attacker to execute arbitrary code remotely on Rosco pods when a Kustomize bake operation is performed...

EUVD-2026-43087

Spinnaker: Improper yaml processing on kustomize bake operations...

GHSA-P68J-Q7HF-3QCP Spinnaker: Improper yaml processing on kustomize bake operations

Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. Workarounds Disable...

Spinnaker: Improper yaml processing on kustomize bake operations

Impact Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider. Workarounds Disable...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, tekton-chains, k3s, tekton-pipelines, cert-manager-istio-csr, cloud-provider-gcp-cloud-controller-manager, flux-notification-controller, node-feature-discovery, cilium, cluster-api-helm-controller, grafana, rancher-agent,...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-76229

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

CVE-2026-76229: Improper Neutralization of Special Elements used in a Command

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: cosign-fips, helm-operator, crossplane-provider-aws-lightsail-fips, flagger, teleport-operator-fips, nri-rabbitmq-fips, virt-controller-fips, gitlab-runner-operator-fips, crossplane-provider-aws-wafv2-fips, steampipe, step-kms-plugin, crossplane-provider-aws-acm-fips...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router, commercial-kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, cosmo-router-fips, karma-fips, karma, kyverno...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router, commercial-kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, cosmo-router-fips, karma-fips, karma, kyverno...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook-fips, cosmo-router, commercial-kyverno, zitadel, fluxcd-kustomize-mutating-webhook, telegraf, cosmo-router-fips, karma-fips, karma, kyverno...