rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

GHSA-848M-R628-VRXW SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

An authenticated user scoped to one namespace/database could invoke a custom API DEFINE API belonging to a different namespace/database, reaching another tenant's endpoint. The route /api/namespace/database/endpoint took the namespace and database from the URL and applied them to the caller's...

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

An authenticated user scoped to one namespace/database could invoke a custom API DEFINE API belonging to a different namespace/database, reaching another tenant's endpoint. The route /api/namespace/database/endpoint took the namespace and database from the URL and applied them to the caller's...

EUVD-2026-45906

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path...

PT-2026-73387

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

CVE-2026-18433 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

EUVD-2026-57061

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10090

A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...

CVE-2026-16543

Kong Operator’s embedded Kong Kubernetes Ingress Controller (KIC) is vulnerable. A user with namespace-scoped Secret creation privileges can cause a cluster-wide denial of service by collecting CA-certificate Secrets across watched namespaces using only a label selector, with no ingress-class or ...

EUVD-2026-50394

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

CVE-2026-16543 Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

CVE-2026-15228 Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-848m-r628-vrxw. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing...

CVE-2026-63735

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...

CVE-2026-63735

SurrealDB is affected: versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing an authenticated user to invoke endpoints in other namespaces/databases by specifying the target scope in the URL path. This could let attackers read sensitive data or trigger...