42 matches found
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: argo-cd, grpc-health-probe-fips, gitlab-kas-fips, wolfictl, kubo, steampipe, kube-arangodb-fips, cerbos, undock, juicefs, rekor, vault-csi-provider, keda-fips, harbor-registry-fips, gitsign, k3d, listmonk, temporal-server-fips, seaweedfs-fips, zot,...
GHSA-Q9HV-HPM4-HJ6X vulnerabilities
Vulnerabilities for packages: q, crossplane-provider-azure-authorization, goreleaser, scorecard, nuclei, trivy-operator, tfsec, kyverno-notation-aws, actions-runner-controller, grafana-alloy, gitea, crossplane-provider-aws-ec2, melange, gptscript, lazygit, pulumi-language-dotnet, witness,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: q, crossplane-provider-azure-authorization, goreleaser, scorecard, nuclei, trivy-operator, tfsec, kyverno-notation-aws, actions-runner-controller, grafana-alloy, gitea, crossplane-provider-aws-ec2, melange, gptscript, lazygit, pulumi-language-dotnet, witness,...
CVE-2026-1229 vulnerabilities
Vulnerabilities for packages: sops, argo-cd, terraform-provider-pagerduty, pulumi-language-java, argo-events-fips, cert-manager-cmctl, wolfictl, hydra, atlantis-fips, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-ec2, terraform-provider-azuread, cerbos, gitlab-rails-ce-fips,...
BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...
BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution
Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...
EUVD-2022-3043
Malicious code in bioql PyPI...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: argo-cd, chart-testing-fips, glow, kubernetes-dashboard-web, pulumi-language-java, cert-manager-cmctl, apache-exporter, gitlab-kas-fips, wolfictl, cluster-autoscaler-fips, amass, kubo, amazon-k8s-cni, steampipe, kube-arangodb-fips, prometheus-redis-exporter-fips,...
CVE-2022-24877
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
GHSA-32GQ-X56H-299C vulnerabilities
Vulnerabilities for packages: sops, chezmoi, sops-fips, grafana-fips, ksops, age, flux-kustomize-controller, flux-kustomize-controller-fips, age-fips, litestream, grafana...
GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: restic, boring-registry, spire-server, goreleaser, kubescape, falcoctl, fluent-bit-plugin-loki, sops, wal-g, nuclei, hugo, hugo-extended, py3-cassandra-medusa, py3-azure-identity, velero, opentelemetry-collector-contrib, sqlpad, tekton-chains, k8sgpt,...
BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...
BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, ferretdb, atlantis-fips, cluster-autoscaler-fips, amass, crossplane-provider-aws-ec2, prometheus-redis-exporter-fips, aws-efs-csi-driver, crossplane-provider-aws-firehose, kubernetes-csi-livenessprobe, rekor, nuclei,...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: falco, kubernetes-csi-livenessprobe-fips, kiam, cortex, prometheus-adapter-fips, cluster-autoscaler-fips, timestamp-authority-fips, kube-oidc-proxy, metrics-server-fips, slsa-verifier, src, dgraph, kubernetes-csi-livenessprobe, aactl, kubeflow-fips,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, dgraph, terraform-provider-sendgrid, scorecard, slsa-verifier, hugo, cue, grpcurl, nghttp2, external-dns, nri-prometheus, ip-masq-agent, pulumi-language-dotnet, git-lfs, flux-notification-controller, weaviate,...
Improper path handling in Kustomization files allows for denial of service
The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...
GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution
Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...