1226 matches found
PT-2026-78561
Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description An issue exists where the operator's ClusterRole is granted permissions equivalent to a cluster administrator. This allows the operator to impersonate other entities, write...
CVE-2026-19670 Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
CVE-2026-19670
Malcolm's nginx Lua RBAC layer pattern-matches the raw percent-encoded URI while nginx routes using the decoded URI, allowing an authenticated low-privilege user to access admin-only paths via encoded URLs like /%68tadmin.php. CVSS 5.4 (MEDIUM); no in-the-wild exploitation reported. No patch vers...
CVE-2026-19670 Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
EUVD-2026-61157
Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...
CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity
A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...
CVE-2026-66782
A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...
CVE-2026-66781
A flaw was found in the Submariner operator. The Submariner Custom Resource CR, used for configuring network connectivity, stores the IPsec pre-shared key PSK in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by...
GO-2026-6114 Watch API authorization bypass in go.etcd.io/etcd/server/v3
In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...
CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction
ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...
BIT-ETCD-2026-73499 etcd: Watch API authorization bypass via open-ended range requests
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...
CVE-2026-70495
A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...
CVE-2026-70495 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters
A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...
EUVD-2026-60361
A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...
CVE-2026-72656
A flaw was found in Elasticsearch. An authenticated user, by submitting a specially crafted ES|QL query, could trigger an unbounded allocation of heap memory. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service DoS condition whe...
CVE-2026-15218
The maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI (Models-as-a-Service) are granted excessive cluster-wide permissions. An attacker who compromises these identities via RCE or a malicious pod can escalate to full cluster admin by creating ClusterRoleBindings or read all clu...
CVE-2026-15218 Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code...
PT-2026-76762
Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description A flaw exists in the search-v2-operator where the search-serviceaccount is assigned overly broad permissions. This allows for the impersonation of users and groups across the entir...
