CLEANSTART-2026-FS21502 Security fixes in argo-rollouts-fips 1.9.1-r2

Package argo-rollouts-fips version 1.9.1-r2 fixes 9 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CLEANSTART-2026-IH82648 Security fixes in argo-rollouts-fips 1.9.1-r1

Package argo-rollouts-fips version 1.9.1-r1 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-41178...

CLEANSTART-2026-EI29741 Security fixes in argo-rollouts-fips 1.9.1-r3

Package argo-rollouts-fips version 1.9.1-r3 fixes 9 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277 Argo Rollouts Dashboard Unauthenticated Mutating Operations

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all network interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection . Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and Retry...

EUVD-2026-67808

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

PT-2026-83300

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: kubewatch, atlantis-fips, argo-rollouts, ory-kratos-fips, argo-cd, ory-kratos, peerdb-flow, kyverno-policy-reporter-fips, atlantis, goreleaser, kyverno-policy-reporter, bento-fips, argo-events-fips, argo-cd-fips, bento, argo-rollouts-fips,...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-fips, opentelemetry-collector-fips, argo-rollouts, keda, argo-cd, grafana-alloy, k8sgpt, argo-workflows, eks-distro-fips, amazon-cloudwatch-agent, nats, opentelemetry-collector-contrib, kubeflow-pipelines, opentelemetry-collector, eks-distro,...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: argo-rollouts, argo-events, kubewatch, goreleaser, bento, kubernetes-event-exporter, kyverno-policy-reporter, argo-cd, atlantis...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: kargo, kubeflow-pipelines, argo-rollouts, opentelemetry-collector-contrib, opentelemetry-collector, k8sgpt, grafana-alloy, argo-workflows, nats, amazon-cloudwatch-agent, splunk-otel-collector...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: istio, kubernetes-csi-external-provisioner, step-ca, temporal-ui-server, crossplane-provider-aws-cloudformation, gke-gcloud-auth-plugin, crossplane-provider-aws-s3, calico, golangci-lint, volume-modifier-for-k8s, cert-exporter, gatus, helm, flux, jitsucom-bulker, src...

CLEANSTART-2026-SZ84105 Security fixes in argo-rollouts-fips 1.9.0-r0

Package argo-rollouts-fips version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-93mq-9ffx-83m2, ghsa-cfpf-hrx2-8rv6, ghsa-gxhx-2686-5h9g, ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-IL70948 Security fixes in argo-rollouts 1.9.0-r0

Package argo-rollouts version 1.9.0-r0 fixes 13 vulnerabilities: ghsa-mh63-6h87-95cp, ghsa-p77j-4mvh-x3m3, ghsa-93mq-9ffx-83m2, ghsa-pc3f-x583-g7j2, ghsa-cfpf-hrx2-8rv6...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: rancher-support-bundle-kit, cluster-api-fips, helm, zarf-fips, cluster-api, neuvector, argo-cd, dynamic-localpv-provisioner-fips, k8sgpt-operator, rke2-runtime, argo-workflows, docker-cli-buildx-fips, skaffold-fips, headlamp-fips, hubble-fips, cert-manager-istio-csr,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: flux-source-controller, crossplane-provider-aws-cloudformation, crossplane-provider-aws-s3, helm, flux, crossplane-provider-aws-kinesis, guac, hydra, xeol, crossplane, wolfictl, grafana, crossplane-provider-azure-managedidentity, crossplane-provider-aws-elasticache,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: flux-source-controller, crossplane-provider-aws-cloudformation, crossplane-provider-aws-s3, helm, flux, crossplane-provider-aws-kinesis, guac, hydra, xeol, crossplane, wolfictl, grafana, crossplane-provider-azure-managedidentity, crossplane-provider-aws-elasticache,...

Malicious code in @bosch-rollouts-extensions/soup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03bf5cb8a8241befda2ac9e7228f23b30a5160b0bd759c8887503d7a6b6cbb7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...