509 matches found
GHSA-HFG8-HC9C-6C3H vulnerabilities
Vulnerabilities for packages: skaffold, kubescape, buildkitd, kaniko, podman, openbao, telegraf, docker-cli-buildx, buildah...
CVE-2026-17106 vulnerabilities
Vulnerabilities for packages: skaffold, kubescape, buildkitd, kaniko, podman, openbao, telegraf, docker-cli-buildx, buildah...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cert-manager, kots, openbao, metrics-server, cloud-provider-aws, cloud-provider-vsphere, opentelemetry-operator, kubernetes-csi-external-provisioner, spicedb, openfga, cloud-provider-azure, zot, descheduler, helm-operator, cloud-provider-gcp-cloud-controller-manager,...
CVE-2026-17106 vulnerabilities
Vulnerabilities for packages: kubescape-server-fips, podman, docker-fips, buildah-fips, skaffold, podman-fips, kaniko-fips, buildah, skaffold-fips, openbao, docker-cli-buildx-fips, buildkitd, openbao-fips, kaniko, kubescape-server, buildkitd-fips, ctop-fips, docker-cli-buildx, telegraf, kubescape...
GHSA-HFG8-HC9C-6C3H vulnerabilities
Vulnerabilities for packages: kubescape-server-fips, podman, docker-fips, buildah-fips, skaffold, podman-fips, kaniko-fips, buildah, skaffold-fips, openbao, docker-cli-buildx-fips, buildkitd, openbao-fips, kaniko, kubescape-server, buildkitd-fips, ctop-fips, docker-cli-buildx, telegraf, kubescape...
BIT-OPENBAO-2026-46405 OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the GET handler, or when an Authorization: Negotiate header is supplied, the response is includes a logical.Auth object in addition to an error message. This results in...
BIT-OPENBAO-2026-46358 OpenBao's Inline Auth Incorrectly Redacted Headers
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...
BIT-OPENBAO-2026-45808 OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...
CVE-2026-46405
A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...
GO-2026-5213 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5526 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5192 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5609 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5192 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5609 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5213 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-5526 vulnerabilities
Vulnerabilities for packages: openbao...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: verticadb-operator, gitlab-runner, lvm-driver, sealed-secrets, spire-server, git-lfs, crossplane-provider-aws-sns, fuse-overlayfs-snapshotter, whereabouts, grpcurl, kustomize, policy-controller, kube-bench, traefik, sftpgo-plugin-kms, bank-vaults, boring-registry,...
CVE-2026-46358
A flaw was found in OpenBao. The inline authentication functionality incorrectly redacted audit log entries, causing non-authentication headers to be removed while authentication-related headers were retained in cleartext. This vulnerability requires an attacker to first compromise access to the...
CVE-2026-45808
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via th...