CVE-2026-44252 Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...

BIT-CONSUL-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

PT-2026-78623

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper enforcement of Role-Based Access Control RBAC authentication roles may allow a local attacker to obtain root privileges. RBAC is a method of restricting system acce...

PT-2026-78561

Name of the Vulnerable Software and Affected Versions search-v2-operator affected versions not specified Description An issue exists where the operator's ClusterRole is granted permissions equivalent to a cluster administrator. This allows the operator to impersonate other entities, write...

CVE-2026-19670

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670

Malcolm's nginx Lua RBAC layer pattern-matches the raw percent-encoded URI while nginx routes using the decoded URI, allowing an authenticated low-privilege user to access admin-only paths via encoded URLs like /%68tadmin.php. CVSS 5.4 (MEDIUM); no in-the-wild exploitation reported. No patch vers...

EUVD-2026-61157

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-66780 Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

CVE-2026-66782

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-66781

A flaw was found in the Submariner operator. The Submariner Custom Resource CR, used for configuring network connectivity, stores the IPsec pre-shared key PSK in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by...

GO-2026-6114 Watch API authorization bypass in go.etcd.io/etcd/server/v3

In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey. The Watch RPC handler normalized open-ended range ends prior to authorization...

CVE-2026-75843 ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

BIT-ETCD-2026-73499 etcd: Watch API authorization bypass via open-ended range requests

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

PT-2026-82773

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.14.0 through 4.14.6 Description An authenticated low-privilege user can read the cluster secret from the manager configuration. This occurs because the logic used to mask sensitive values is disabled whenever any update-config...

CVE-2026-70495

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...

CVE-2026-70495 Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

A flaw was found in search-v2-operator. This component's search-serviceaccount has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve...