Vulnerability related to permission and access control issues in Red Hat StreamsHub Console for Apache Kafka

A permission and access control vulnerability exists in Red Hat StreamsHub Console for Apache Kafka versions 0.2.0 through 0.12.10 and 0.13.0 through 0.14.2. This vulnerability arises because a Kubernetes tenant with permission to create custom Console resources can set...

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

CVE-2026-77524

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-110220

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

EUVD-2026-99261

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

PT-2026-111844

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

CVE-2026-110220: Server-Side Request Forgery (SSRF)

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

Kubeflow Hub server request forgery vulnerability

Kubeflow Hub versions 0.3.17 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from an issue with server-side request forgeing in the modelregistry.kubeflow.org/url annotation. It may allow namespace users to steal the controller ServiceAccount token. By...

SUSE CVE-2026-55769

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

EUVD-2026-88379

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-96740

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

PT-2026-99963

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka affected versions not specified Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without...

CVE-2026-100705

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...