GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux, prometheus-operator, timestamp-authority, step-ca, sigstore-scaffolding, rclone, goreleaser, cosign, grafana-mimir, restic, grafana-agent-operator, flux-image-reflector-controller, nuclei, hugo-extended, py3-azure-identity, hugo, kubescape, pulumi, druid,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: flux, helm-push, rclone, kapp-controller, amazon-cloudwatch-agent-operator, opa, gobump, clickhouse-operator, kpt, docker-credential-gcr, nri-haproxy, mongo-tools, hubble, cilium-cli, fzf, rabbitmq-cluster-operator, cluster-api-azure-controller, wgcf,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux, cosign, age, datadog-agent, cilium-cli, act, cluster-api-azure-controller, gitea, docker-cli-buildx, go-discover, trivy-operator, tflint, argo-cd, cilium, crossplane-provider-family-azure, slsa-verifier, buildah, pulumi-language-java, buildkitd, atlantis,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: flux, crossplane-provider-aws-eks, helm-push, rclone, datadog-agent, cilium-cli, gitea, docker-cli-buildx, trufflehog, flux-helm-controller, crossplane-provider-aws-cloudfront, extism, trivy-operator, argo-cd, crossplane-provider-aws-elasticache,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: flux, crossplane-provider-aws-eks, helm-push, rclone, datadog-agent, cilium-cli, gitea, docker-cli-buildx, trufflehog, flux-helm-controller, crossplane-provider-aws-cloudfront, extism, trivy-operator, argo-cd, crossplane-provider-aws-elasticache,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: helm-diff, nfpm, grafana-alloy-fips, k9s, kubevela-fips, reports-server, crossplane-provider-aws-ec2, gitlab-operator, databricks-cli, trufflehog-fips, terraform-provider-databricks, vcluster, external-secrets-operator, crossplane-provider-aws-s3-fips, zarf, xeol-fip...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G 代码问题漏洞

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...