GO-2024-2918 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, prometheus-operator, goreleaser, argo-workflows, cosign, ksops, restic, buildkitd, flux, pulumi, spire-server, flux-image-reflector-controller, step-ca, hugo, fulcio, step, bank-vaults, secrets-store-csi-driver-provider-azure, up, chezmoi,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tekton-chains, kubernetes-dashboard-auth, kyverno-notation-aws, controller-gen, portieris, clickhouse-operator, cni-plugins, wgcf, ko, kind, k8sgateway, cerbos, terraform-mcp-server, harbor-cli, ipfs-cluster, step-kms-plugin, eksctl, swagger, k8sgpt, wal-g, cilium-cl...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher-agent, tekton-chains, trivy-operator, kyverno, pulumi, rootlesskit, gatus, rancher, ko, istio, syft, kots, gh, k9s, gomplate, crossplane-provider-family-azure, step-kms-plugin, cloud-provider-aws, docker, eksctl, crossplane-provider-azure-sql, k8sgpt, sops,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-kinesis, argo-workflows, kyverno-notation-aws, kyverno, pulumi, flux-helm-controller, syft, kots, cerbos, k9s, trufflehog, vcluster, gomplate, xeol, crossplane-provider-family-azure, docker, crossplane-provider-azure-sql, sops,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-kinesis, argo-workflows, kyverno-notation-aws, kyverno, pulumi, flux-helm-controller, syft, kots, cerbos, k9s, trufflehog, vcluster, gomplate, xeol, crossplane-provider-family-azure, docker, crossplane-provider-azure-sql, sops,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, extism, terraform-provider-pagerduty, gitlab-rails-ce, crossplane, snyk-cli, sops, goreleaser, grafana-alloy, cert-manager-cmctl-fips, crossplane-provider-aws-cloudformation, crossplane-provider-family-azure, argo-rollouts-fips,...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599: Improper Check for Unusual or Exceptional Conditions

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G code issue vulnerabilities

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...

PT-2021-22237

Name of the Vulnerable Software and Affected Versions WAL-G versions prior to 1.1 Description The issue arises when a non-libsodium build of WAL-G is used, causing it to silently ignore the libsodium encryption key and upload backups in cleartext. This behavior is considered a violation of the...