GO-2024-2918 vulnerabilities

Vulnerabilities for packages: tekton-chains, goreleaser, nuclei, argo-workflows, timestamp-authority, ksops, policy-controller, harbor-registry, boring-registry, falcoctl, flux-image-reflector-controller, flux-source-controller, guac, py3-cassandra-medusa, druid, sigstore-scaffolding, terragrunt,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: aws-application-networking-k8s, hubble, libnvidia-container, nova, nuclei, kpt, steampipe, helm-push, aws-eks-pod-identity-agent, nri-mysql, guac, docker-cli, yunikorn-k8shim, tkn, controller-gen, terraform-provider-azapi, kuberlr, rancher-system-upgrade-controller,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: syft, nuclei, kubernetes, steampipe, rancher, gitlab-kas, guac, openbao, tkn, datadog-agent, k9s, k8sgpt, prometheus-operator, pulumi-language-yaml, rancher-machine, cluster-api-azure-controller, flux-notification-controller, docker-cli-buildx, caddy, podman, chisel,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, syft, tfsec, nuclei, crossplane, helm-push, guac, openbao, datadog-agent, k9s, hydra, pulumi-language-yaml, flux-notification-controller, docker-cli-buildx, argo-rollouts, pulumi-kubernetes-operator, gitaly, rclone, cluster-api, snyk-cli,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, syft, tfsec, nuclei, crossplane, helm-push, guac, openbao, datadog-agent, k9s, hydra, pulumi-language-yaml, flux-notification-controller, docker-cli-buildx, argo-rollouts, pulumi-kubernetes-operator, gitaly, rclone, cluster-api, snyk-cli,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-cd, terraform-provider-databricks, crossplane-provider-azure-managedidentity, packer, ratify-fips, crossplane-provider-aws-memorydb-fips, gptscript, vault-fips, trivy-fips, nuclei, crossplane-provider-aws-rds, crossplane-provider-keycloak, terragrunt-fips,...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

GHSA-VRMR-F2QH-3HHF Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Improper use of cryptographic key in wal-g

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Information Disclosure

github.com/wal-g/wal-g is vulnerable to information disclosure. The vulnerability exists when user uses libsodium encryption for their backup files which is not available but are silently processed and uploaded as plaintext...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

Code injection

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

CVE-2021-38599

CVE-2021-38599 affects WAL-G prior to version 1.1. In non-libSodium builds, WAL-G silently ignores the libsodium encryption key and uploads backups in plaintext, creating an information disclosure vulnerability. Affected software: WAL-G backup tool (used with PostgreSQL, MySQL/MariaDB, MS SQL Ser...

CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build e.g., one of the official binary releases published as GitHub Releases is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to...

WAL-G 代码问题漏洞

WAL-G is an archive recovery tool for PostgreSQL, MySQL/MariaDB and MS SQL Server MongoDB and Redis beta. A code issue vulnerability exists in WAL-G prior to 1.1, which stems from a lack of checking for the existence of libsodium keys in non-libsodium builds...