CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73842

OpenChoreo OpenKubernetes platform vulnerability CVE-2026-73842 affects cluster-gateway internal proxy. Before versions 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certifica...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266: Unintended Proxy or Intermediary

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

EUVD-2026-57424

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-18677 Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

On August 19, 2026, the Cisco Product Security Incident Response Team PSIRT published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco Crosswork Security Hardening Release: August 2026...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.12.1 security update

This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Health Check Operator deploys the Node Health Check controller. The controller identifies unhealthy nodes and uses a remediation provider to remediate the...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.3.1 security update

This is an updated version of the Storage-Based Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Storage-Based Remediation Operator is an OLM Operator for managing STONITH Block Device SBD configurations and remediations for high-availability clustering...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.7.1 security update

This is an updated version of the Machine Deletion Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Machine Deletion Remediation MDR Operator works with the Node Health Check NHC Operator to reprovision unhealthy nodes using the Machine API. The MDR...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.13.1 security update

This is an updated version of the Self Node Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Self Node Remediation Operator works in conjunction with the machine health check or the node health check to provide automatic remediation of unhealthy nodes by...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability v5.7.1 security update

This is an updated version of the Node Maintenance Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Maintenance Operator works in conjunction with the machine health check or the node health check to provide automatic remediation of unhealthy nodes by rebooting...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.8.1 security update

This is an updated version of the Fence Agents Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Fence Agents Remediation Operator fences and remediates nodes using well-known agents. The remediation includes fencing the unhealthy node, using a fencing...

CVE-2026-18677: Authentication Bypass by Spoofing

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

PT-2026-71208

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2026-28757

The CVE-2026-28757 entry refers to a protection mechanism failure in Intel(R) Workload Services Framework software operating in Ring 3 (User Applications). The vulnerability could allow an escalation of privilege by an unprivileged adversary paired with a privileged user, requiring local access, ...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2026-28757

Protection mechanism failure for some IntelR Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may...