badPods

Bad Pods 这是一组用于创建具有不同提升权限的 Pod 的 manifests。可快速演示允许 hostNetwork、hostPID、hostPath、hostIPC 和 privileged 等安全敏感 Pod 属性所带来的影响。 更多背景信息，请参阅我们的博客文章：Bad Pods: Kubernetes Pod 权限提升。 目录 Bad Pods 阵容 先决条件 组织方式 使用方法 总体思路 使用示例 从克隆的本地仓库创建全部八个 Bad Pods 通过 Github 创建全部八个 Bad Pods 创建全部八个反向 shell Bad Pods 使用...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, logstash-exporter, xcaddy, azcopy-fips, extism, haproxy-ingress, src, rancher-webhook, neuvector, crossplane-provider-aws-sns, cue-fips, flannel-cni-plugin, nvidia-gpu-operator-validator, sbomqs, cosign-fips, glab, cilium, vgpu-util,...

GO-2026-4382 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: kubevela, aws-load-balancer-controller, crossplane-provider-aws, flux-source-controller, haproxy-ingress, weaviate, apko, flux-notification-controller, dive, buildkitd, flux-image-automation-controller, zot, sigstore-scaffolding, nodetaint, pulumi-kubernetes-operator...

GHSA-QF34-295C-26V8 Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend

Impact A privilege escalation vulnerability affects Woodpecker instances using the Kubernetes backend. The pipeline option backendoptions.kubernetes.serviceAccountName was passed directly to the pod spec without any admin gating. Who is impacted: any operator running the Kubernetes backend. Any...

CVE-2026-44938

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...

CVE-2026-44938

CVE-2026-44938 affects Fleet’s agent-side deployer, which did not filter security‑sensitive keys from namespaceLabels when applying them to a target namespace. An attacker with git push access to a Fleet-monitored repo could overwrite Pod Security Standards (PSS) enforcement labels, weakening adm...

CVE-2026-44938

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a Fleet-monitored...

CVE-2026-46680

A flaw was found in containerd, an open-source container runtime. Containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. This vulnerability allows a crafted container image to bypass the Kubernetes runAsNonRoot restrictio...

Rancher has Privilege Escalation from Project Owner to Host

Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission PSA labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this...

GHSA-VX8H-4PRV-G744 Rancher has Privilege Escalation from Project Owner to Host

Impact A vulnerability has been identified in Rancher Manager that allows users assigned the Project Owner role to modify Pod Security Admission PSA labels on namespaces within their projects. Under the default role configuration, an attacker with the following access pattern can exploit this...

GHSA-864G-863M-VCVQ Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a...

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml or BundleDeployment.spec.options.namespaceLabels when applying them to the target namespace. An attacker with git push access to a...

PT-2026-54763

Name of the Vulnerable Software and Affected Versions Rancher Fleet affected versions not specified Description An authentication bypass exists in the webhook component. Additionally, a Pod Security Standard PSS bypass can be achieved through the manipulation of namespace labels. Recommendations ...

CVE-2026-44947 Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher

A missing clean-up in the legacy Project Role Template Binding PRTB reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission PSA permissions after an administrator removes those permissions from a RoleTemplate...

CVE-2026-44947

A missing clean-up in the legacy Project Role Template Binding PRTB reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security Admission PSA permissions after an administrator removes those permissions from a RoleTemplate...

CVE-2026-44947

CVE-2026-44947 describes a missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher, affecting versions 2.13.0–2.13.7 and 2.14.0–2.14.3. The issue allows users to retain unauthorized Pod Security Admission (PSA) permissions after an administrator removes those per...

CVE-2026-42296

A flaw was found in Argo Workflows. A user with create Workflow permission can bypass the templateReferencing: Strict security control. This bypass allows the user to gain host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane...

CVE-2026-42296

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...

EUVD-2026-28894

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod...