CVE-2026-73613

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-73269

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to...

CVE-2026-72508

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-72508

The CVE-2026-72508 issue affects the multicloud-operators-subscription component in Red Hat Advanced Cluster Management (RHACM). A namespace-admin tenant can perform a confused‑deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount, enabling deplo...

CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-72508

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

EUVD-2026-57439

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to...

CVE-2026-73269

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

CVE-2026-65017 describes a masking bypass in Apache Airflow’s Config API in multi-team deployments. A Viewer with only configuration-read access could read a team-scoped Celery broker URL and its embedded credentials in cleartext, even though the global option is masked. The issue arises because ...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

EUVD-2026-57268

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971

CVE-2026-68971 (Apache Airflow) describes a cross-team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. A team-aware auth manager failed to consult the team-scoped permission, treating...

CVE-2026-68076

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

CVE-2026-18698

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

CVE-2026-72537

Authentik Authentik (through version 2026.5.6) contains a privilege escalation vulnerability where an attacker with a source-scoped SCIM provisioning token can take over existing local user accounts, including the superuser. The SCIM user ingest function accepts pre-existing local accounts by use...

CVE-2026-68870

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix UAF in configfs release path The gpio-virtuser configfs release path uses a guard mutex to protect the device structure. However, the device is freed before the mutex cleanup runs, causing mutexunlock to opera...

CVE-2026-71850

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...