GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: policy-controller, gitlab-runner, cilium-cli, gitlab-kas, istio, teleport, kyverno, ksops, openbao, witness, crossplane-provider-azure-authorization, kubernetes, ko, argo-events, go-discover, docker-machine-driver-harvester, terragrunt, buildkitd, spire-server,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-kyverno-fips, weaviate, sops, grafana-pyroscope, step-kms-plugin-fips, kubo-fips, tekton-pipelines-fips, ko-fips, chainctl, traefik-fips, cluster-api-aws-controller, seaweedfs, cluster-api-aws-controller-fips, velero, temporal-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: policy-controller, gitlab-runner, cilium-cli, goreleaser, crossplane-provider-aws-lambda, kyverno, crossplane-provider-aws-kms, crossplane-provider-aws-memorydb, crossplane-provider-aws-s3, ksops, openbao, witness, crossplane-provider-azure-authorization,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: policy-controller, gitlab-runner, cilium-cli, goreleaser, crossplane-provider-aws-lambda, kyverno, crossplane-provider-aws-kms, crossplane-provider-aws-memorydb, crossplane-provider-aws-s3, ksops, openbao, witness, crossplane-provider-azure-authorization,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, crossplane-provider-aws-rds-fips, kyverno-policy-reporter-plugins-kyverno-fips, omnictl-multiarch-fips, terraform-fips, gitea-fips, dagger, helm-diff-fips, sops, terraform, ratify, sops-fips, tekton-pipelines-fips, crossplane-provider-aws-route5...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-3043

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, gitea-fips, weaviate, external-dns, grafana-pyroscope, step-kms-plugin-fips, spegel-fips, kubo-fips, tekton-pipelines-fips, volume-modifier-for-k8s, secrets-store-csi-driver-provider-azure-fips, chainctl, amazon-k8s-cni, cortex-fips, loki-3.6,...

CVE-2022-24877

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: age, litestream, flux-kustomize-controller, age-fips, flux-kustomize-controller-fips, sops, sops-fips, grafana-fips, ksops, chezmoi, grafana...

GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller

Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: argo-workflows, boring-registry, fluent-bit-plugin-loki, policy-controller, wal-g, zarf, sigstore-scaffolding, restic, rclone, timestamp-authority, external-dns, zot, goreleaser, sops, thanos, trino, tempo, ksops, druid, cosign, flux-image-reflector-controller,...

BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...

BIT-KUSTOMIZE-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, up, request-1279, weaviate, external-dns, sops, nri-prometheus, volume-modifier-for-k8s, crossplane-provider-aws-eks, prometheus-adapter-fips, cass-operator, k8ssandra-operator-fips, kaf, velero, aws-efs-csi-driver, mc-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: up, cortex, dgraph, kubernetes-csi-livenessprobe-fips, prometheus-adapter-fips, kubescape, terraform-provider-sendgrid, spark-operator, dynamic-localpv-provisioner-fips, plutono-fips, buildkitd, aactl, scorecard, aws-efs-csi-driver-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner, metrics-server, wireguard-go, ko, mc, nghttp2, buildkitd, flux-source-controller, gomplate, cortex, pulumi-language-yaml, kind, kots, hugo, sigstore-scaffolding, nginx-mainline, terraform-provider-azurerm, prometheus-blackbox-exporter, de...

Improper path handling in Kustomization files allows for denial of service

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted kustomization.yaml to cause Denial of Service at controller level. In multi-tenancy deployments this can lead to multiple...