GO-2026-5774 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, fluxcd-kustomize-mutating-webhook-fips, zitadel, karma, cosmo-router, karma-fips, cosmo-router-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, fluxcd-kustomize-mutating-webhook-fips, zitadel, karma, cosmo-router, karma-fips, cosmo-router-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, fluxcd-kustomize-mutating-webhook-fips, zitadel, karma, cosmo-router, karma-fips, cosmo-router-fips...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: karma, kyverno, fluxcd-kustomize-mutating-webhook, telegraf...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: karma, kyverno, fluxcd-kustomize-mutating-webhook, telegraf...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: karma, kyverno, fluxcd-kustomize-mutating-webhook, telegraf...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: ytt, hydra, kubeflow-katib, http-echo, kubernetes-replicator, pvc-autoresizer, docker-machine-driver-linode, ip-masq-agent, crossplane-provider-aws-cloudformation, crossplane-provider-aws-cloudfront, headlamp, container-object-storage-interface, hubble,...

CVE-2026-54725

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

PT-2026-66831

Name of the Vulnerable Software and Affected Versions vault-secrets-webhook versions prior to 1.23.1 Description The software reads the vault.security.banzaicloud.io/vault-addr annotation from ConfigMaps or Secrets without validation or allowlisting. When a value prefixed with vault: is present,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: tailscale, goreleaser, flux-source-controller, victoriametrics-cluster, nodetaint, mountpoint-s3-csi-driver, flux-notification-controller, hubble, go, osv-scanner, flux, flux-image-automation-controller, aws-network-policy-agent, victoriametrics, aws-privateca-issuer...

EUVD-2026-17133

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

KubePlus 安全漏洞

KubePlus is a Kubernetes multi-tenant application management platform developed by cloud-ark. KubePlus 4.1.4 contains security vulnerabilities, which stem from server-side request forgery and command injection during the processing of the chartURL field by the mutating webhook and...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

CVE-2026-29954 affects KubePlus 4.1.4, specifically the mutating webhook and kubeconfiggenerator. The vulnerability arises when processing the chartURL field of ResourceComposition resources: the value is only URL-encoded and not validated, enabling SSRF. More critically, kubeconfiggenerator conc...

CVE-2025-47907 vulnerabilities

Vulnerabilities for packages: ytt, kubeflow-katib, http-echo, kubernetes-csi-driver-hostpath, cert-manager-istio-csr, aws-network-policy-agent, spegel, skaffold, temporal, terragrunt, aws-nuke, apache-exporter, trivy-operator, flux-helm-controller, pgpool2exporter, spire-server, kubevela, snyk-cl...

GHSA-2CGQ-H8XW-2V5J CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

CRI-O vulnerable to an arbitrary systemd property injection

Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: I believe that ExecStart with an arbitrary command works here too, but I haven't figured out how to...

Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure and malicious redirection. If --profiling is enabled on the kube-apiserver, an attacker with a control over a validating or mutating webhook are able to access the kube-apiserver process logs and are able to redirect...