233 matches found
CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath
CVE-2026-21008 – HostPath에 마운트된 Kubernetes 서비스 계정 토큰 프로그램 코드 YAML + Python 익스플로잇 vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: - name: app image: nginx volumeMounts: -...
cve-2024-7646
CVE-2024-7646 Описание По умолчанию nginx.ingress.kubernetes.io/server-snippet отключен, но из-за этой CVE nginx.ingress.kubernetes.io/auth-tls-verify-client всё ещё может вставлять пользовательские фрагменты или даже lua-код. Исправленная версия контроллер ingress-nginx v1.11.2 — исправлено...
CVE-2022-3294
익스플로잇 참조: https://github.com/kubernetes/kubernetes/issues/113757 https://github.com/kubernetes/kubernetes/issues/119640 https://github.com/kubernetes/sig-security/blob/main/sig-security-external-audit/security-audit-2021-2022/findings/Kubernetes%20v1.24%20Final%20Report.pdf 열거: 1. 마스터 노드의 IP를...
CVE-2024-36539
Доказательство концепции PoC уязвимости небезопасных разрешений в Contour v1.28.3 Этот репозиторий содержит скрипт доказательства концепции PoC, демонстрирующий уязвимость небезопасных разрешений в Contour v1.28.3. Эта уязвимость позволяет злоумышленникам получить доступ к конфиденциальным данным...
CVE-2026-47701
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
EUVD-2026-77578
The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...
CVE-2026-19486
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
CVE-2026-19486
CVE-2026-19486 is a Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder (versions prior to 2026-06-01 on Google Cloud Platform). An unauthenticated attacker can exploit it to leak the Compute Engine default service account access token , r...
CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
EUVD-2026-76021
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
PT-2026-89808
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
PT-2026-82731
Name of the Vulnerable Software and Affected Versions Grafana Alloy affected versions not specified Description The prometheus.operator.servicemonitors component allows a user with permissions to create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file...
CVE-2026-12564
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...
EUVD-2026-58281
Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...
CVE-2026-72648
Elastic Cloud on Kubernetes (ECK) has a vulnerability CVE-2026-72648 where a Fleet Server authentication token is written in cleartext into the generated workload specification instead of being mounted from the Kubernetes Secret. This allows principals with access to workload specs in the affecte...
CVE-2026-72648 Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...
CVE-2026-72648 Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
Cleartext Storage of Sensitive Information in an Environment Variable CWE-526 in Elastic Cloud on Kubernetes ECK can lead to information disclosure via Retrieve Embedded Sensitive Data CAPEC-37. When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account...