GO-2024-2918 vulnerabilities

Vulnerabilities for packages: policy-controller, buildkitd, flyte, flux, chezmoi, timestamp-authority, py3-cassandra-medusa, argo-events, sops, trivy, rekor, cortex, spire-server, py3-azure-identity, flux-source-controller, trino, restic, fluent-bit-plugin-loki, zarf, druid, argo-workflows,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k8sgateway, cis-operator, k3s, azure-service-operator, amazon-cloudwatch-agent-operator, wait-for-port, regclient, cni-plugins, kubernetes-dashboard-api, fzf, nri-apache, containerd, swagger, harbor-cli, emissary, timescaledb-tune, dex, migrate, zot, nri-nginx,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: k3s, chezmoi, go-discover, apko, hcloud, containerd, cilium, dagger, ksops, minio, zot, gitlab-runner, step, tekton-chains, step-issuer, rancher-machine, terraform-provider-azurerm, pulumi-language-java, act, argo-cd, aactl, cloud-provider-aws, falco-no-driver,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: apko, gitsign, terraform-provider-pagerduty, vcluster, dagger, ksops, q, crossplane-provider-aws-kms, zot, crossplane-provider-aws-dynamodb, gitlab-runner, kyverno-notation-aws, terraform-provider-azurerm, cluster-api, cerbos, pulumi-language-java, argo-cd, aactl,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: apko, gitsign, terraform-provider-pagerduty, vcluster, dagger, ksops, q, crossplane-provider-aws-kms, zot, crossplane-provider-aws-dynamodb, gitlab-runner, kyverno-notation-aws, terraform-provider-azurerm, cluster-api, cerbos, pulumi-language-java, argo-cd, aactl,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-cd, hydra-fips, kubevela-fips, kyverno-notation-aws-fips, kyverno-policy-reporter-plugins-kyverno-fips, flux-helm-controller, flux-kustomize-controller, grafana-fips, trufflehog-fips, gitness, actions-runner-controller-fips, cg, hydra,...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G 代码问题漏洞

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...

CVE-2021-38599: Improper Check for Unusual or Exceptional Conditions

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...