GHSA-XV9W-7V6Q-HPJH vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

GHSA-Q675-QJ96-32M9 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs, seaweedfs-operator, seaweedfs-fips, mattermost-fips, seaweedfs-rocksdb, gitlab-workhorse-ce, seaweedfs-rocksdb-fips...

GHSA-XV9W-7V6Q-HPJH vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-44162 vulnerabilities

Vulnerabilities for packages: kube-logging-operator...

CVE-2026-11769

A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and...

OpenClaw: Combined POSIX shell options could confuse exec revalidation

Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...

GHSA-8WG3-5MCM-FJQ8 OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...

GHSA-XR4F-MJXJ-W6W5 OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

Summary The bundled device-pair plugin exposed /pair on normal chat command surfaces. In affected releases, authorized non-owner chat senders could issue device-pairing bootstrap codes without having owner, admin, or pairing scope. This issue does not affect unauthenticated users. The caller must...

GHSA-QJPC-QF9M-XWMR OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

Summary In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client's declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline. This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secre...

GHSA-83W9-H5WV-J9XM OpenClaw: Node pairing reconnection could confuse approval scope state

Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate pairing state in a way that changed the approval scope decision. This advisory is scoped to the named feature and configuration. It does not change...

GHSA-P2FH-F5FC-44HR OpenClaw: memory-wiki ingest could read local files with operator.write scope

Summary memory-wiki ingest could read local files with operator.write scope. In affected versions, a Gateway caller with operator.write access to the plugin tool could read arbitrary local file paths instead of staying within the intended ingest sources. This advisory is scoped to the named featu...

GHSA-V6R2-JH58-XX6W OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

Summary Marketplace runtime extension metadata could point at unscanned payloads. In affected versions, a package selected for installation by a trusted operator could redirect runtime loading toward hidden package content that was not scanned as expected. This advisory is scoped to the named...

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

Summary Marketplace runtime extension metadata could point at unscanned payloads. In affected versions, a package selected for installation by a trusted operator could redirect runtime loading toward hidden package content that was not scanned as expected. This advisory is scoped to the named...

GHSA-9R4W-JG96-92MV vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, teleport, tbot...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: k9s-fips, drone, gitlab-operator, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, gogatekeeper, k8sgpt, jfrog-cli, manifest-tool, ratify, chaos-mesh, xeol, zarf, helm-exporter-fips, gitlab-operator-fips, ocm-cli, helm-push, kyverno-notation-aws-fips, k9s,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: k9s-fips, drone, gitlab-operator, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, gogatekeeper, jfrog-cli, manifest-tool, ratify, chaos-mesh, xeol, zarf, helm-exporter-fips, gitlab-operator-fips, ocm-cli, helm-push, kyverno-notation-aws-fips, k9s, ratify-fips,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: k9s-fips, drone, gitlab-operator, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, gogatekeeper, k8sgpt, jfrog-cli, manifest-tool, ratify, chaos-mesh, xeol, zarf, helm-exporter-fips, gitlab-operator-fips, ocm-cli, helm-push, kyverno-notation-aws-fips, k9s,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: k9s-fips, drone, gitlab-operator, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, gogatekeeper, jfrog-cli, manifest-tool, ratify, chaos-mesh, xeol, zarf, helm-exporter-fips, gitlab-operator-fips, ocm-cli, helm-push, kyverno-notation-aws-fips, k9s, ratify-fips,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: k9s-fips, drone, gitlab-operator, envoy-gateway-fips, consul-k8s-fips, crossplane-fips, gogatekeeper, jfrog-cli, manifest-tool, ratify, chaos-mesh, xeol, zarf, helm-exporter-fips, gitlab-operator-fips, ocm-cli, helm-push, kyverno-notation-aws-fips, k9s, ratify-fips,...