provisioner

Provisioner Overview Provisioner is a developer-focused provisioning sidekick for single-board computers SBCs, particularly U-Boot-based platforms. It provides a self-contained environment to: Remotely access boards Automate bring-up workflows Provision kernels and root filesystems Execute flashi...

CVE-2025-62878

CVE-2025-62878: Local Path Provisioner Path Traversal Overview Item| Value ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 Severity| Critical CVSS 10.0 CWE| CWE-23 Relative Path Traversal Affected Component| rancher/local-path-provisioner Affected Versions| v0.0.27 v0.0.32 Fixed...

GO-2026-6865 vulnerabilities

Vulnerabilities for packages: mc, docker-compose, kpt, keda, azcopy, gitleaks, vault-secrets-webhook, minio, juicefs, kubewatch, bom, grafana, k6, amazon-cloudwatch-agent, datadog-agent, kbld, scorecard, zarf, verticadb-operator, dagdotdev, task, flux, manifest-tool, op-geth, dapr, etcd, migrate,...

CVE-2026-116591 vulnerabilities

Vulnerabilities for packages: mc, docker-compose, kpt, keda, azcopy, gitleaks, vault-secrets-webhook, minio, juicefs, kubewatch, bom, grafana, k6, amazon-cloudwatch-agent, datadog-agent, kbld, scorecard, zarf, verticadb-operator, dagdotdev, task, flux, manifest-tool, op-geth, dapr, etcd, migrate,...

GHSA-FPMH-FRQ8-7RJ8 vulnerabilities

Vulnerabilities for packages: mc, docker-compose, kpt, keda, azcopy, gitleaks, vault-secrets-webhook, minio, juicefs, kubewatch, bom, grafana, k6, amazon-cloudwatch-agent, datadog-agent, kbld, scorecard, zarf, verticadb-operator, dagdotdev, task, flux, manifest-tool, op-geth, dapr, etcd, migrate,...

CLEANSTART-2026-BX77375 security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node

Security vulnerability affects the nfs-subdir-external-provisioner package. A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node...

CLEANSTART-2026-FB85377 In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secr...

Security vulnerability affects the nfs-subdir-external-provisioner package. In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry...

CLEANSTART-2026-HM58494 In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files

Security vulnerability affects the nfs-subdir-external-provisioner package. In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files...

CLEANSTART-2026-YO29710 Security fix for CVE-2020-8558 applied in: nfs-subdir-external-provisioner 4.0.2-r4

Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IW40098 Security fix for CVE-2021-25741 applied in: nfs-subdir-external-provisioner 4.0.2-r4

Security vulnerability affects the nfs-subdir-external-provisioner package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-97693

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...

CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...

CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. From 0.6.0.beta1 until 0.7.1, there is insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user who can execute...

CLEANSTART-2026-PO24101 Security fix for GHSA-f6x5-jh6r-wrfv applied in: litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, kubernetes-dns-node-cache-fips 1.25.0-r1, argo-events 1.6.3-r1, local-static-provisioner-fips 2.8.0-r0, grafana-alloy-fips 1.12.1-r0, kubevela 1.10.5-r0

GHSA-f6x5-jh6r-wrfv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD85749 Security fix for GHSA-r6j8-c6r2-37rr applied in: local-static-provisioner-fips 2.8.0-r3, local-static-provisioner 2.8.0-r0, kyverno-policy-reporter-kyverno-plugin 1.6.4-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.6.4-r5

GHSA-r6j8-c6r2-37rr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UN07096 Security fix for GHSA-4x4m-3c2p-qppc applied in: local-static-provisioner-fips 2.8.0-r3, kyverno-policy-reporter-kyverno-plugin 1.6.4-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.6.4-r5

GHSA-4x4m-3c2p-qppc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AG54423 Security fix for GHSA-p77j-4mvh-x3m3 applied in: helm-fips 3.20.2-r0, dynamic-localpv-provisioner 4.5.0-r1, argo-workflows 3.6.19-r3, fulcio-fips 1.8.7-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, litestream 0.5.14-r1, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, cert-manager 1.19.4-r1

GHSA-p77j-4mvh-x3m3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GI83888 Security fix for GHSA-j5w8-q4qc-rx2x applied in: litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, argo-events 1.6.3-r1, local-static-provisioner-fips 2.8.0-r0, grafana-alloy-fips 1.12.1-r0

GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FO62255 Security fix for GHSA-vvgc-356p-c3xw applied in: litestream 0.3.14-r2, litestream 0.3.14-r3, ip-masq-agent 2.12.0-r1, kserve-rest-proxy 0.12.0-r0, kubernetes-dns-node-cache-fips 1.25.0-r1, local-static-provisioner-fips 2.8.0-r0

GHSA-vvgc-356p-c3xw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YO86500 Security fix for GHSA-8r3f-844c-mc37 applied in: nfs-subdir-external-provisioner-fips 4.0.18-r0, metallb 0.13.12-r3

GHSA-8r3f-844c-mc37 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...