CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: loki-fips, fluent-operator, helm, longhorn-cli-fips, descheduler-fips, openbao-fips, crossplane-provider-azure-relay, oauth2-proxy-fips, cluster-api-provider-vsphere-fips, crossplane-provider-aws-cloudtrail, grafana-rollout-operator-fips, k9s-fips, falcosidekick,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, grafana-operator, flux-source-controller, gh, osv-scanner, hubble, secrets-store-csi-driver-provider-aws, mountpoint-s3-csi-driver, nova, victoriametrics, actions-runner-controller, omnibump, temporal, flux-image-reflector-controller,...

CVE-2025-62878

The CVE-2025-62878 exposure is a path traversal flaw in the Local Path Provisioner (rancher.io/local-path) via the parameters.pathPattern in StorageClass. A malicious user can craft pathPattern (using relative segments like ../) to cause PersistentVolumes to target arbitrary host paths, e.g., ove...

CVE-2025-62878 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories...

CVE-2025-62878 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories...

Exploit for CVE-2025-62878

CVE-2025-62878: Local Path Provisioner Path Traversal Over...

GO-2026-4425 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern in github.com/rancher/local-path-provisioner

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern in github.com/rancher/local-path-provisioner...

PT-2026-6528

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern in github.com/rancher/local-path-provisioner...

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Impact A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. Example: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata:...

GHSA-JR3W-9VFR-C746 Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Impact A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. Example: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata:...

PT-2026-6543

Name of the Vulnerable Software and Affected Versions rancher.io/local-path-provisioner versions prior to 0.0.34 Description A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or...

PT-2026-6443

Impact A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories. Example: apiVersion: storage.k8s.io/v1 kind: StorageClass metadata:...

CVE-2025-65637 affecting package local-path-provisioner for versions less than 0.0.21-20

CVE-2025-65637 affecting package local-path-provisioner for versions less than 0.0.21-20. A patched version of the package is available...

Azure Linux 3.0 Security Update: kubernetes / local-path-provisioner (CVE-2020-8565)

The version of kubernetes / local-path-provisioner installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-8565 advisory. - In Kubernetes, if the logging level is set to at least 9, authorization and bear...

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5. A patched version of the package is available...

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12. A patched version of the package is available...

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

AZL-38488 CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: helm, tflint, dynamic-localpv-provisioner, crossplane-provider-aws, crossplane, temporal-ui-server, rqlite, pulumi, falcosidekick, envoy-ratelimit-fips, aws-load-balancer-controller, atlantis, prometheus-elasticsearch-exporter, hugo, melange, fulcio,...