GO-2025-4100 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, falco-no-driver, tekton-pipelines-fips, k9s, helm-mapkubeapis, ctop, cluster-api-helm-controller-fips, helm-fips, livekit-cli, apm-server-fips, grype, manifest-tool, helm-diff, docker-cli-buildx-fips, flux-helm-controller, kube-arangodb-fips,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: step-fips, terraform-provider-google, cluster-proportional-autoscaler-fips, kyverno-notation-aws, pulumi-language-dotnet, caddy-fips, opa-fips, pulumi, pulumi-language-java, sigstore-scaffolding, smarter-device-manager-fips, google-osconfig-agent, portieris-fips,...

GO-2025-4175 vulnerabilities

Vulnerabilities for packages: sqlexporter-fips, cluster-autoscaler-fips, velero-plugin-for-aws-fips, terraform-provider-google, kubernetes-csi-external-provisioner-fips, mkcert, kube-logging-operator-custom-runner-fips, temporal, sealed-secrets-fips, terraform-provider-sendgrid-fips,...

GO-2022-0574 vulnerabilities

Vulnerabilities for packages: opa...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: opa, spire-server, policy-controller, zarf, conftest, snyk-cli, kubescape, tfsec, kots, cosign, k8sgpt, zot...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: step, ksops, melange, osv-scanner, dex, kwok, minio, sigstore-scaffolding, hubble-ui, grafana-agent-operator, grpc-health-probe, dagger, terragrunt, zot, k3s, k3d, sops, spire-server, temporal, kube-rbac-proxy, opentelemetry-collector-contrib, k8sgpt,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, kubernetes-dashboard-api, headlamp, nri-f5, oauth2-proxy, cluster-api-azure-controller, cerbos, helm-push, k3d, swagger, regclient, kyverno-notation-aws, k8sgpt, kubernetes-csi-driver-nfs, nri-memcached, src, kubernetes-dashboard, dive,...

CVE-2026-73285

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285

RustFS (distributed object storage in Rust) up to version 1.0.0-rc.1 is affected. The external OPA authorization configured via RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs incorrectly sets PreparedIamAuth.needs_existing_object_tag for PreparedIamMode::Opa, which can cause maybe_merge_object...

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5. A patched version of the package is available...

EUVD-2026-48437

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

AZL-93273 CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-50197

Summary: CVE-2026-50197 affects zalando/skipper’s OpenPolicyAgent integration. When clients use HTTP/1.1 Transfer-Encoding: chunked or HTTP/2 without Content-Length, the opaAuthorizeRequestWithBody flow exposes an empty raw_body and parsed input.parsed_body to OPA, causing policy checks that rely...

PYSEC-2026-1361 OpaMiddleware does not filter HTTP OPTIONS requests

Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...