17 matches found
CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...
CVE-2026-71475
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...
EUVD-2026-56899
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...
CVE-2026-71475 Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...
CVE-2026-71475
The CVE describes a vulnerability in insights-client for RHEL9 where a compromised spoke can inject an unencoded ClusterID into the Insights API URL path. Since the ClusterID is used directly in the request path without validation or URL encoding, authenticated requests can be redirected to unint...
CVE-2026-71475
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...
CVE-2026-66808
A flaw was found in hypershift-addon-operator. A hub-cluster administrator with write access to the hypershift-operator-install-flags ConfigMap can inject malicious command-line arguments into the privileged install Job. This vulnerability, known as argument injection, allows the attacker to pull...
randstad-linux-azure-architect-poc
Randstad Azure Linux Architect — POC GitHub: https://gith...
EUVD-2012-3837
Malware in sbrugna...
MAL-2025-36311 Malicious code in test-mlw2-spoke-riled-vells-liths (npm)
The package test-mlw2-spoke-riled-vells-liths was found to contain malicious code...
Malicious code in test-mlw2-nohow-spoke (npm)
The package test-mlw2-nohow-spoke was found to contain malicious code...
Malicious code in test-mlw2-spoke-riled-vells-liths (npm)
The package test-mlw2-spoke-riled-vells-liths was found to contain malicious code...
MAL-2025-35876 Malicious code in test-mlw2-nohow-spoke (npm)
The package test-mlw2-nohow-spoke was found to contain malicious code...
Zero Trust—Part 1: Networking
Enterprises used to be able to secure their corporate perimeters with traditional network controls and feel confident that they were keeping hackers out. However, in a mobile- and cloud-first world, in which the rate and the sophistication level of security attacks are increasing, they can no...
Code injection
The FlexVPN implementation in Cisco IOS 15.2 and 15.3 allows remote authenticated users to cause a denial of service spoke crash via spoke-to-spoke traffic, aka Bug ID CSCtz02622...