53 matches found
FreeBSD : redpanda-connect -- memory exhaustion via oversized AMQP frames (5d69ee28-adb9-11f1-9d0e-4c526214c986)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5d69ee28-adb9-11f1-9d0e-4c526214c986 advisory. amqp091-go developers report: Before version 1.13.0, a compromised or malicious AMQP broker can force t...
CVE-2026-82266
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
CVE-2026-82266
Redpanda through 26.2.2 ships with its Admin API bound to 0.0.0.0:9644 and admin_api_require_auth defaulting to false, meaning unauthenticated requests are treated as superusers . An attacker with network access to port 9644 can create and delete broker accounts, modify cluster configuration, and...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
EUVD-2026-67797
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
PT-2026-83289
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin api require auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...
redpanda-connect -- memory exhaustion via oversized AMQP frames
amqp091-go developers report: Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial of servi...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: ocm-cli, consul-k8s, helm-push, ratify-fips, ocm-kubernetes-controller-fips, kubescape-operator-fips, gitness, manifest-tool, gatekeeper, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm, steampipe, helm-set-status,...
GO-2026-5336 vulnerabilities
Vulnerabilities for packages: redpanda-console, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, flux, grype, crossplane-fips, terragrunt, xeol-fips, trivy-operator-fips, argo-workflows-fips, chainloop-cli-fips, steampipe, jfrog-cli, kargo, coder-fips, crossplane, scorecard,...
GO-2026-5015 vulnerabilities
Vulnerabilities for packages: kubernetes, cilium, falco-no-driver, redpanda-console, harbor, flux-fips, knative-kafka-broker, kubernetes-fips, kuma, dagger, syft-fips, prometheus-fips, argo-events-fips, tekton-pipelines, commercial-grafana, gatekeeper, flux, etcd, grype, kube-conformance,...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: datadog-agent, k3s, witness, goreleaser, grafana-alloy, loki, prometheus, rclone, vcluster, kubevela, gitlab-runner, cri-tools, maru, minio, nuclei, redpanda, opentelemetry-collector-contrib, ollama, teleport, k8sgpt, weaviate, eksctl, opentelemetry-collector,...
CVE-2026-48978 vulnerabilities
Vulnerabilities for packages: ocm-cli, consul-k8s, helm-push, ratify-fips, ocm-kubernetes-controller-fips, kubescape-operator-fips, gitness, manifest-tool, gatekeeper, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm, harvester-fips, steampipe,...
GHSA-XF85-363P-868W vulnerabilities
Vulnerabilities for packages: ocm-cli, consul-k8s, helm-push, ratify-fips, ocm-kubernetes-controller-fips, kubescape-operator-fips, gitness, manifest-tool, gatekeeper, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm, harvester-fips, steampipe,...
GHSA-JXPM-75MH-9FP7 vulnerabilities
Vulnerabilities for packages: ocm-cli, consul-k8s, helm-push, ratify-fips, ocm-kubernetes-controller-fips, kubescape-operator-fips, gitness, manifest-tool, gatekeeper, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm, steampipe, helm-set-status,...
CVE-2026-50151 vulnerabilities
Vulnerabilities for packages: ocm-cli, consul-k8s, helm-push, ratify-fips, ocm-kubernetes-controller-fips, kubescape-operator-fips, gitness, manifest-tool, gatekeeper, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm, steampipe, helm-set-status,...
GHSA-XHF5-7WJV-PQXP vulnerabilities
Vulnerabilities for packages: consul-k8s, helm-push, kubescape-operator-fips, newrelic-infrastructure-agent, dagger, docker-compose, manifest-tool, syft-fips, kubescape-operator, gatekeeper, grype, crossplane-fips, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-hel...
CVE-2026-46680 vulnerabilities
Vulnerabilities for packages: consul-k8s, helm-push, kubescape-operator-fips, newrelic-infrastructure-agent, dagger, docker-compose, manifest-tool, syft-fips, kubescape-operator, gatekeeper, grype, redpanda-operator, kube-arangodb-fips, trivy-operator-fips, xeol-fips, rancher-helm,...
GHSA-M7CR-M3PV-HGRP vulnerabilities
Vulnerabilities for packages: redpanda-console, flux-fips, goreleaser, gitaly, dagger, syft-fips, argo-events-fips, flux, grype, crossplane-fips, terragrunt, xeol-fips, trivy-operator-fips, argo-workflows-fips, chainloop-cli-fips, steampipe, jfrog-cli, kargo, coder-fips, crossplane, scorecard,...