PT-2026-76763

Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, can inject malicious shell commands or SQL statements. This issue exists because the...

GO-2026-4316 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, commercial-kyverno, aws-lambda-runtime-interface-emulator, custom-pod-autoscaler-fips, cloudbeat, fleet-server-fips, kyverno-fips, custom-pod-autoscaler, aws-lambda-runtime-interface-emulator-fips...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: tigera-operator, yace, prometheus-blackbox-exporter, sigstore-scaffolding-fips, vexctl, kubernetes-dashboard-metrics-scraper, kubernetes-ingress-defaultbackend-fips, neuvector-dbgen-fips, prometheus-pushgateway, prometheus-mysqld-exporter, kube-logging-operator,...

GO-2026-4382 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2026-4316 vulnerabilities

Vulnerabilities for packages: custom-pod-autoscaler...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: k8sgpt-operator, grpcurl, dive, vault-k8s, pulumi-language-dotnet, gke-gcloud-auth-plugin, pulumi-language-yaml, fuse-overlayfs-snapshotter, pulumi-kubernetes-operator, newrelic-infrastructure-agent, nri-prometheus, kaf, memcached-exporter, yq, gobuster, flux,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, dive, spire-controller-manager, nova, cluster-api-provider-vsphere, kubernetes-csi-driver-nfs, mockgen, rabbitmq-messaging-topology-operator, containerd, wait-for-port, libnvidia-container, nginx-prometheus-exporter, nri-consul,...

EUVD-2026-45029

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Summary The allow-list fix for CVE-2026-31892 GHSA-3wf5-g532-rcrr, and its follow-up coverage of hostNetwork/securityContext/serviceAccountName in GHSA-3775-99mw-8rp4, is incomplete. workflow/util/merge.go ValidateUserOverrides / SanitizeUserWorkflowSpec walk only the top-level fields of...

CLEANSTART-2026-GR38496 Security fixes in aws-eks-pod-identity-agent 0.2.1-r1

Package aws-eks-pod-identity-agent version 0.2.1-r1 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71845

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

EUVD-2026-56902

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71474

A flaw in insights-client (package insights-client-rhel9 ) in Red Hat Advanced Cluster Management for Kubernetes causes the application to log request headers—including the cloud.openshift.com pull-secret bearer token —when it receives a non-200 response. A local user with access to pod logs on t...

CVE-2026-71474

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...

CVE-2026-71845

A flaw in insights-client causes the setDefault() function to log the value of every environment variable it processes, including CCX_TOKEN , a bearer credential used in disconnected cluster deployments . When glog verbosity is set to level 2 or higher, the token is written in clear text to the p...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

CVE-2026-71845 Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...