CVE-2026-87052

A flaw was found in operator-foundry. The absence of automated dependency-update and vulnerability-scanning configurations in the repository increases the risk of undetected security vulnerabilities. This lack of automated security checks could potentially lead to the inclusion of known vulnerabl...

CVE-2026-87051

A flaw was found in operator-foundry. The path-containment check, designed to restrict file access within a build context, only performs string-based validation. It fails to resolve symbolic links symlinks, allowing an attacker to create a symlink within the build context that points to files or...

CVE-2026-87050

A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags e.g., @v0, @v4 instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration CI pipeline through an...

CVE-2026-87049

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without...