CVE-2026-65838

Skipper , an HTTP router and reverse proxy, has a bypass in its OPA authorization filter prior to version 0.27.35 . The opaAuthorizeRequestWithBody filter uses ExtractHttpBodyOptionally, which leaves OPA with an empty parsed_body when an oversized Content-Length request exceeds the -open-policy-a...

cupcake

Cupcake AIエージェントにルールを守らせる。 AIエージェントのポリシー実施 レイヤー。モデルコンテキストを消費せずに、パフォーマンスとセキュリティを向上させます。 決定論的なルール順守 をエージェントに実現。インタラクティブな例 ルールをコンテキストからポリシー・アズ・コードに移すことでパフォーマンス向上 。 アラートをトリガー し、ルールに繰り返し違反する悪質なエージェントをタイムアウトにします。 Cupcakeはエージェントイベントをインターセプトし、Open Policy Agent OPA...

gatekeeper

Gatekeeper Gatekeeper 与 OPA 有何不同？ 与使用 OPA 及其边车 kube-mgmt（即 Gatekeeper v1.0）相比，Gatekeeper 引入了以下功能： 一个可扩展、参数化的策略库 用于实例化策略库的原生 Kubernetes CRD（即“约束”） 用于扩展策略库的原生 Kubernetes CRD（即“约束模板”） 用于变更支持的原生 Kubernetes CRD 审计功能 外部数据支持 快速开始 查看安装说明，将 Gatekeeper 组件部署到你的 Kubernetes 集群。 文档 请参阅 Gatekeeper 网站 获取更深入的信息。...

mesh-kridik

mesh-kridik Kubernetes サービスメッシュのセキュリティを強化しましょう！ mesh-kridik は、istio サービスメッシュを使用した Kubernetes クラスターに対してさまざまなセキュリティチェックを実行し、セキュリティレポートを出力するオープンソースのセキュリティチェッカーです。 セキュリティチェックテストは、istio セキュリティのベストプラクティス の完全な実装です。 セキュリティチェックは、istio サービスメッシュを使用した Kubernetes クラスターに対して実行され、OPA（Open Policy...

mesh-kridik

mesh-kridik Enhance your Kubernetes service mesh security !! mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report The security checks tests are the full implementation of istio security...

kubeeye

English | 中文 KubeEye is a cloud-native cluster inspection tool specifically designed for Kubernetes, capable of identifying issues and risks within the Kubernetes cluster based on custom rules. QuickStart Installation Download the installation package from Releases, which includes Helm chart, dem...

CVE-2026-45730

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730

Nuclio is a serverless framework for real-time events and data processing. The vulnerability exists in the Nuclio Dashboard's project management API on write paths (PUT /api/projects/{id}, DELETE /api/projects). The root cause is that these endpoints construct PermissionOptions without setting Me...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

CVE-2026-45730 Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

EUVD-2026-70212

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

AZL-99315 CVE-2026-84304 affecting package opa 0.63.0-5

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CLEANSTART-2026-SP20560 Security fixes in opa 1.19.1-r1

Package opa version 1.19.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-XH81643 Security fixes in opa-fips 1.19.1-r2

Package opa-fips version 1.19.1-r2 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-NW77012 Security fixes in opa-fips 1.19.1-r1

Package opa-fips version 1.19.1-r1 fixes 7 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

AZL-98391 CVE-2026-37236 affecting package opa 0.63.0-5

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

GO-2022-0587 vulnerabilities

Vulnerabilities for packages: opa...

GO-2022-0574 vulnerabilities

Vulnerabilities for packages: opa...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: conftest, kots, spire-server-fips, tfsec, zot, conftest-fips, policy-controller-fips, cosign, cosign-fips, k8sgpt, snyk-cli, zarf, opa, kubescape, spire-server, policy-controller...