Kubernetes
Monthly
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Code injection in Apache Camel K (2.0.0-2.9.2 and 2.10.1) lets an authorized custom-resource author smuggle arbitrary Kubernetes object definitions through YAML in CR configuration, which the operator then materializes using its own elevated service-account privileges. Because the operator typically holds broad cluster permissions, this converts limited CR-authoring rights into unauthorized creation of arbitrary Kubernetes resources - a privilege-escalation and in-cluster RCE primitive. Apache-released fixes exist; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authenticated Kubernetes tenant overwrite or delete another tenant's shared cluster-level RBAC binding. Because cluster-scoped RBAC objects are keyed only by the bare custom-resource name with no namespace disambiguation, a low-privileged tenant who creates a same-named InstanaAgent CR in a namespace they control can silently clobber or revoke a victim tenant's ClusterRoleBinding, destroying that agent's cluster monitoring access. No public exploit identified at time of analysis; a vendor patch is available.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Shell command injection in Nuclio's Dashboard build pipeline (versions 1.6.19–1.17.1) allows an authenticated user with function-create permission to execute arbitrary commands inside the Dashboard container by embedding shell metacharacters in the `spec.build.tempDir` field. The post-exploitation impact is substantially amplified because the Dashboard container's Kubernetes service account holds wildcard access to Secrets, Pods, Jobs, and Deployments within its namespace, enabling full namespace-level privilege escalation from a single low-privileged API call. No public exploit identified at time of analysis, but the fix commit (PR #4190) includes working proof-of-concept test cases demonstrating semicolon, pipe, subshell, and backtick injection payloads.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `bufferAllocLimit` DoS mitigation via two unwrapped allocation paths - `Buffer.concat(list, totalLength)` and `Buffer.from({length: N})` - committing unbounded host external memory in a single synchronous C++ call that V8's timeout mechanism cannot interrupt. A publicly available PoC confirms that a 200-byte sandbox payload inflates host RSS by hundreds of megabytes per invocation, making a single crafted request sufficient to OOM-kill a host process running inside a Docker container, Kubernetes pod, or AWS Lambda function. No public exploit identified in CISA KEV at time of analysis, though functional exploit code is embedded in the GHSA advisory itself.
Server-side request forgery in Budibase automation steps (all versions prior to 3.41.3) exposes internal network resources - including cloud metadata endpoints, private databases, and Kubernetes APIs - to any authenticated user with automation creation rights. Five automation step types (outgoing webhook, Zapier, n8n, Slack, Discord) invoke node-fetch directly without any IP validation, completely bypassing the blacklist module that guards only the REST API integration. A second compounding flaw causes the REST API blacklist to default to an empty allowlist when the BLACKLIST_IPS environment variable is unset, meaning default Budibase deployments carry zero SSRF protection across all outbound request vectors. No CISA KEV listing exists, but the GHSA advisory provides source-level code references that substantially document the attack surface.
Missing authentication on OpenChoreo's cluster-gateway (before 1.0.2 and 1.1.2) exposed caller-facing management APIs on the same externally reachable listener used for agent WebSocket traffic, letting network-reachable attackers hit /api/proxy/ and /api/exec/ without any credentials. In multi-cluster deployments this permits proxying the data-plane Kubernetes API and executing commands inside workload pods, effectively yielding cross-cluster control. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-qh9r-j7rp-4x2m) and CVSS 9.6 mark it as critical.
Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; risk is amplified because the internal listener effectively brokers cross-tenant, multi-cluster control-plane access.
Authorization bypass in OpenChoreo's Kubernetes developer platform allows any authenticated user with a project-scoped grant to execute commands in and exfiltrate wirelogs from components belonging to entirely different projects within the same namespace. The root cause is that the `component:exec` and `wirelogs:view` API handlers in `exec.go` and `wirelogs.go` evaluate authorization using the attacker-controlled `project` query parameter rather than the authoritative `comp.Spec.Owner.ProjectName` field - a textbook CWE-639 insecure direct object reference. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 score and low-privilege network exploitation path make this a serious cross-tenant isolation failure in multi-project deployments.
OS command injection in OpenChoreo's Workflow Plane templates allows authenticated developers to execute arbitrary shell commands inside workflow pods by supplying malicious workflow parameters. Affected versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2 directly interpolated user-controlled parameters such as image-name, image-tag, app-path, and build-env into sh -c shell text rather than passing them through container.env, a classic CWE-78 pattern. Compounding the injection risk, affected privileged Podman templates lacked the hostUsers: false isolation setting, creating a credible path from workflow pod compromise to Kubernetes node-level impact. No public exploit has been identified at time of analysis, but the fix commits confirm the vulnerability mechanism.
Unauthenticated API access in OpenChoreo's Backstage backend exposes all `/api/*` routes to any network-reachable attacker, enabling catalog enumeration, scaffolder log reads, and catalog location creation or deletion without credentials. The root cause is two Backstage safety flags - `dangerouslyDisableDefaultAuthPolicy` and `dangerouslyAllowOutsideDevelopment` - hardcoded to `true` in both `app-config.yaml` and `app-config.production.yaml`, effectively disabling Backstage's authentication layer in all pre-fix deployments. No public exploit identified at time of analysis; vendor-released patches are available at v1.0.4, v1.1.4, and v1.2.1.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.
Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.
Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. No public exploit is identified at time of analysis, but the flaw is fixed in 5.36.0 and carries a critical 9.9 CVSS.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. 'a-b' vs 'a_b') were assigned identical datastore identifiers and silently shared backing storage. No public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor advisory (GHSA-4f3f-65vx-r34f) and the fixing commit, which now uses the immutable resource UID.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. record_transformer records) into the config without escaping newlines, an attacker injects a `<match **>` block using the core `@type exec` plugin to run arbitrary commands. A working proof-of-concept is published in the GitHub advisory (GHSA-mjqf-28ph-426h); publicly available exploit code exists, but there is no CISA KEV listing indicating active exploitation.
Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. This is a missing-authorization (CWE-862) flaw reported by Kong; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. Reported by Kong; no public exploit identified at time of analysis and not listed in CISA KEV.
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
Complete cluster compromise via missing authentication in Microsoft Azure Kubernetes Service allows any unauthenticated remote attacker to gain administrative privileges over the network. No user interaction is required, and the vulnerability is automatable, enabling full cluster takeover with potential cross-tenant impact. No public exploit code or active exploitation has been reported, and a vendor patch is available.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.
Improper authorization in cert-manager 1.18.0 through 1.19.5 and 1.20.0-1.20.2 lets a namespaced tenant with standard Challenge/Order create rights forge ACME Challenge resources that reference a ClusterIssuer, bypassing DNS01 solver selectors (dnsZones, dnsNames, matchLabels) so the controller uses cluster-wide DNS credentials for attacker-chosen provider settings and names. The primary consequence is disclosure of shared ClusterIssuer DNS credentials - notably acme-dns X-Api-User and X-Api-Key headers - enabling cross-tenant credential theft in multi-tenant clusters. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass and control-plane information disclosure in Envoy Gateway (versions >= 1.8.0-rc.0 to < 1.8.1, and all releases < 1.7.4) allows any in-cluster pod that can reach the xDS gRPC server on port 18000 to read sensitive xDS resources without valid credentials. The flaw affects only deployments running in GatewayNamespaceMode, where the JWT StreamInterceptor mishandles State-of-the-World DiscoveryRequests and no UnaryInterceptor guards the Fetch endpoints, exposing TLS private keys (SDS), clusters/endpoints, and routing configuration. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 7.4 (High).
Arbitrary file disclosure in Envoy Gateway's controller allows a low-privileged tenant who can create an EnvoyExtensionPolicy to read sensitive files from the gateway controller pod. A path-normalization gap in the security.lua critical-path check (CWE-20) lets attacker-supplied Lua bypass the read restriction using double-slash paths (e.g. //etc/passwd), exposing Kubernetes service-account tokens, TLS certificates, and process environment. No public exploit identified at time of analysis, but the vendor advisory documents the exact bypass and CVSS is rated 9.1.
Privilege escalation in Argo Workflows before 3.7.15 and 4.0.6 lets a low-privileged user who can submit Workflows bypass the Strict/Secure templateReferencing protections and inject an arbitrary strategic-merge PodSpecPatch into the artifact garbage-collection pod. Because the fix for CVE-2026-31892 only walked top-level WorkflowSpec fields and allow-listed WorkflowSpec.ArtifactGC wholesale, its nested WorkflowLevelArtifactGC.PodSpecPatch flowed unmodified into util.ApplyPodSpecPatch, allowing an attacker to spawn a pod with privileged: true, hostPath volumes, hostNetwork: true, and an attacker-chosen image and command. This is an incomplete-fix regression; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Privilege escalation in Woodpecker CI (v1.0.0 through v3.15.0) running the Kubernetes backend lets any user with Push permission on a connected repository set the pipeline pod's serviceAccountName to an arbitrary ServiceAccount in the pipeline namespace, inheriting its RBAC rights. Because the option was passed straight to the pod spec with no admin gating, a low-privilege contributor can pivot to a privileged ServiceAccount and exfiltrate secrets (DB credentials, API keys, TLS certs) or take over the cluster. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is available in v3.16.0 via a default-off gating flag.
Unauthenticated remote denial of service in StacklokLabs MKP (Model Context Protocol for Kubernetes) server versions before 0.4.1 lets a single crafted `tools/call` request against the default `:8080` endpoint exhaust process memory. The `get_resource` tool accepts attacker-controlled `limitBytes`/`tailLines` values with no upper bound and streams the entire Kubernetes pod-log response into an in-memory `bytes.Buffer`, driving an OOM kill (dynamic reproduction grew RSS from 25.8 MB to 1,179.3 MB on one request). Publicly available exploit code exists in the GitHub Security Advisory; there is no public evidence of active exploitation.
Unauthenticated arbitrary file write in OpenCost (all versions up to and including releases before 1.119.1) lets remote clients POST to the /serviceKey endpoint and overwrite the GCP service account key file (key.json) with attacker-controlled content, with no authentication and no input validation. An attacker can either corrupt the credential file to break GCP cost collection or inject their own valid service-account key to redirect the target's billing/cost data to an attacker-owned GCP project. Publicly available exploit code exists (a full reproducible PoC is in the GHSA advisory); no public evidence of active exploitation and no CISA KEV listing.
Information disclosure with integrity impact in the Spotfire Server modules of Spotfire Enterprise, Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes allows a remote, unauthenticated attacker to obtain sensitive data and alter server-side state once a victim is lured into a passive interaction (UI:P), such as opening a crafted link or analysis. The CVSS 4.0 base score is 8.7 (High) with high confidentiality and integrity impact and low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Argument injection in Flux159 MCP Server Kubernetes before 3.9.0 lets remote attackers redirect kubectl operations to an attacker-controlled API server by smuggling a leading-dash `--server` flag through the resourceType and name parameters of the kubectl_get, kubectl_describe, and kubectl_delete structured tools. Because the injected values bypass the assertNoDangerousFlags check, the operator's bearer token is transmitted to the external server, enabling full Kubernetes cluster compromise. Reported by VulnCheck, it carries CVSS 4.0 9.3, has publicly available exploit code, and a vendor patch in release 3.9.0; there is no confirmed active exploitation.
Server-Side Request Forgery in the guardrails-detectors component allows a remote attacker to submit a crafted XML Schema Definition (XSD) that forces the service to make attacker-directed requests, reaching cloud metadata services, the Kubernetes API, internal MinIO object storage, and other internal endpoints, and to read local files such as service account tokens and pod secrets. Because the flaw is blind SSRF chained to local file disclosure inside a container/Kubernetes context, an attacker can harvest credentials and pivot deeper into the cluster. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope-changing impact make this high priority for affected AI-guardrails deployments.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Memory-exhaustion denial of service in soupsieve, the CSS selector engine bundled with Beautiful Soup 4 (beautifulsoup4), lets remote unauthenticated attackers crash Python services by submitting a large comma-separated CSS selector to soupsieve.compile() or Beautiful Soup's .select()/.select_one(). Each comma-delimited item is parsed into a ~976-byte object graph with no cap on list length, so a ~500 KB selector string of 'a,a,a,...' expands to roughly 244 MB of heap (a ~488x amplification), triggering OOM kills or MemoryError. A working proof-of-concept is published in the advisory; no CISA KEV listing or in-the-wild exploitation is reported.
Remote code execution in Nuclio's Kubernetes cron-trigger implementation allows an attacker who can submit a NuclioFunction specification to inject arbitrary shell commands that execute inside CronJob pods running as root. Two unsanitized paths exist: header keys are interpolated verbatim inside double-quoted shell arguments (breaking quoting context), and event bodies processed with Go's strconv.Quote survive as unescaped `$()` command substitution sequences. Both paths were dynamically verified on the latest release (1.15.27), and the resulting CronJobs persist as orphaned resources even after function deletion because they carry no ownerReferences. A publicly available PoC with full reproduction steps exists per the GHSA advisory. No KEV listing at time of analysis.
Authentication bypass in Portainer Community Edition (2.39.0-2.39.3 and 2.40.0 through 2.42.x) lets an unauthenticated network attacker seize full administrative control of a freshly deployed, uninitialized instance. During the five-minute post-deployment setup window the /api/restore and /api/users/admin/init endpoints stay reachable without credentials, so an attacker who wins the race can create the first admin account or restore a crafted backup and take over the platform along with every Docker, Swarm, Kubernetes and ACI environment it manages. No public exploit identified at time of analysis and it is not on CISA KEV, but the fix is available in 2.39.4 and 2.43.0.
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration.
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score.
Authenticated denial of service in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4 allows any user holding a valid API token to exhaust Central's resources. Because Central does not cap the nesting depth of queries served on its authenticated GraphQL API, a single deeply nested query can drive excessive CPU and memory consumption and take down the RHACS management plane. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low-privilege network vector makes it trivial for any token holder to trigger.
Arbitrary CWD-file read and inode-tampering in the oras-go v2 content/file tar extractor allows an attacker who controls an OCI artifact to hardlink files from the pulling process's working directory into the extract tree. When a victim runs 'oras pull' (or any Go program using oras-go/v2/content/file) against a malicious layer marked with the io.deis.oras.content.unpack annotation, the flawed ensureLinkPath helper validates a resolved hardlink target but passes the original relative Linkname to os.Link, causing link(2) to resolve it against the process CWD instead of the extract base. Publicly available exploit code exists (detailed PoC and regression test in the advisory); this is not listed in CISA KEV and no active exploitation is confirmed.
Privilege-escalation via admission-control bypass in Rancher Fleet allows an attacker with git push access to a Fleet-monitored repository to overwrite Pod Security Standards (PSS) enforcement labels on target namespaces. Because Fleet's agent-side deployer failed to filter security-sensitive keys (notably the `pod-security.kubernetes.io/` prefix) from `namespaceLabels` in `fleet.yaml` or `BundleDeployment.spec.options.namespaceLabels`, an attacker can downgrade namespace admission enforcement and deploy privileged or otherwise restricted workloads that PSS would normally block. No public exploit identified at time of analysis; the flaw was privately reported through responsible disclosure by a NATO NCSC researcher and is not listed in CISA KEV.
Server-Side Request Forgery in Sigstore Fulcio (before v1.8.6) lets a compromised or malicious OIDC issuer redirect the OIDC Discovery client's metadata fetches to attacker-chosen hosts, enabling blind SSRF against internal systems, poisoning of the verifier cache via a substituted jwks_uri so forged signatures validate, and leakage of the in-cluster Kubernetes ServiceAccount token to third-party hosts. Unauthenticated remote attackers who control a configured (or wildcard-matched) issuer can chain these into trust compromise of the certificate authority. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in SUSE Rancher's in-cluster admission webhook (rancher-webhook) lets a network-adjacent, unauthenticated attacker forge FleetWorkspace admission payloads so that workspace-related Kubernetes objects are created with attacker-chosen identity data. Affected releases span Rancher 0.7.0–0.7.10, 0.8.0–0.8.7, 0.9.0–0.9.6 and 0.10.0–0.10.7, with integrity impact but no direct confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is documented in SUSE/Rancher advisory GHSA-h83p-cq95-vph4.
Offline administrator password recovery in Kestra OSS (versions prior to 1.3.24) stems from its BasicAuth component storing the admin credential as a fast SHA-512 hash. An attacker who already holds read access to the backing PostgreSQL database can extract that hash and crack it offline at high speed, then log in as administrator; in Kubernetes deployments this further exposes the cluster ServiceAccount token and all K8s Secrets, enabling vertical privilege escalation. No public exploit identified at time of analysis and not on CISA KEV; EPSS data was not provided.
Denial of service in the Linux kernel's WireGuard module causes the receive/decryption path to permanently stall for an individual peer under heavy network load. Affected stable trees (notably 6.12.34 through 6.12.73, with the same defect originating in 5.15/6.1 where threaded NAPI became default) can have inbound traffic to a specific WireGuard peer halt completely once the per-peer rx_queue fills its 1024-packet backlog and wg_packet_rx_poll is never rescheduled. The condition was reported by multiple production Cilium/Kubernetes operators; there is no public exploit identified at time of analysis and EPSS is very low (0.10%, 1st percentile).
Server-side request forgery in Budibase (@budibase/backend-core before 3.39.9) lets authenticated users with automation permissions bypass the SSRF blacklist via DNS rebinding, reaching loopback, RFC1918, and cloud metadata endpoints from the Budibase host. The outbound fetch helper validates a hostname's resolved IP against the blacklist but never pins that IP to the subsequent socket, so node-fetch performs a second DNS lookup that can resolve to an internal address. Because several automation steps return upstream response bodies into automation output, the result is a non-blind read primitive; publicly available exploit code (a rebinding PoC) exists, though EPSS is low (0.24%, 15th percentile) and it is not on CISA KEV.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding pod-creation rights, who restores a container from a maliciously crafted checkpoint image. The CRI restore path trusts Container Device Interface (CDI) annotations embedded in untrusted checkpoint metadata instead of the pod's create-time spec, letting the attacker smuggle arbitrary CDI edits (host device nodes and mounts) into the restored container. It affects containerd v2.1.0-2.1.8, v2.2.0-2.2.4 and v2.3.0-2.3.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Mutual-TLS bypass in Traefik v3.7.0 and v3.7.1 lets unauthenticated remote attackers reach backends protected by wildcard-router `TLSOptions` (for example `Host("*.example.com")` with `RequireAndVerifyClientCert`). The `SNICheck` domain-fronting middleware resolves TLS options for the HTTP `Host` header via exact map lookups only, so an attacker completing the TLS handshake under a permissive SNI on the same entrypoint can then send a `Host` header for the wildcard-protected backend and skip the client-certificate requirement. Publicly available exploit code exists in the GitHub Security Advisory PoC; this is independent of the prior HTTP/3 mTLS issue.
Cross-tenant container deletion in the Radius Kubernetes controller (versions <= v0.57.1) allows a tenant with Deployment annotation-edit rights to coerce the high-privilege controller into deleting another tenant's container resource by injecting a forged radapp.io/status JSON blob. The flaw is a classic Confused Deputy (CWE-441/CWE-20) that yields an availability-only impact, is most severe in multi-tenant installs, and currently has publicly available exploit code via the GHSA advisory but no public exploit identified at time of analysis in CISA KEV.
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.25.0 allows a tenant with permission to create Function or Environment CRDs to obtain CAP_SYS_TIME inside function/runtime containers by bypassing an incomplete capability denylist in the ValidatePodSpecSafety admission webhook. The denylist only blocked six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE) and omitted CAP_SYS_TIME and others, letting tenant-controlled code modify the container's system clock. No public exploit identified at time of analysis, but the upstream patch and CRD diff are publicly visible in fission/fission PR #3465.
Path traversal in Fission Kubernetes serverless framework prior to version 1.25.0 allows authenticated tenants to write files outside the intended extraction directory by submitting a crafted package archive. The fetcher sidecar (fission-fetcher) processes attacker-controlled Package.Spec.Source.URL or Deployment.URL archives via Unarchive in pkg/utils/zip.go, where filepath.Join was used without verifying the resolved path stayed under the destination, enabling cross-tenant file overwrite, tampering with mounted secret/config volumes, or overwriting the fetcher binary itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes backends when an Ingress uses the ingress-nginx compatibility provider with both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider generates a host-only 'sibling' router carrying only a non-terminal RedirectRegex middleware that still routes to the protected backend, so a crafted request evades the redirect and is proxied without any annotation-derived middleware. Reported by VulnCheck with a published advisory; no public exploit is identified at time of analysis, though the technique is fully documented and trivially reproducible.
Code injection in Apache Camel K (2.0.0-2.9.2 and 2.10.1) lets an authorized custom-resource author smuggle arbitrary Kubernetes object definitions through YAML in CR configuration, which the operator then materializes using its own elevated service-account privileges. Because the operator typically holds broad cluster permissions, this converts limited CR-authoring rights into unauthorized creation of arbitrary Kubernetes resources - a privilege-escalation and in-cluster RCE primitive. Apache-released fixes exist; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.
Administrative takeover of the Eclipse aeriOS Identity Manager (IdM) is possible because the current development-version deployment exposes its Keycloak server and PostgreSQL backing database to the network (Kubernetes NodePort services, and PostgreSQL bound to all interfaces under Docker Compose) while shipping fixed, publicly documented default credentials for the Keycloak admin and the PostgreSQL user. An attacker who can reach these services logs in with the published defaults to read or modify identity data - users, roles, client credentials, sessions, and cryptographic material - and can mint privileged identities or tokens trusted by other aeriOS components. No official release exists yet; there is no CISA KEV listing and no public exploit identified at time of analysis, though the credentials are effectively public in the source repository.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authenticated Kubernetes tenant overwrite or delete another tenant's shared cluster-level RBAC binding. Because cluster-scoped RBAC objects are keyed only by the bare custom-resource name with no namespace disambiguation, a low-privileged tenant who creates a same-named InstanaAgent CR in a namespace they control can silently clobber or revoke a victim tenant's ClusterRoleBinding, destroying that agent's cluster monitoring access. No public exploit identified at time of analysis; a vendor patch is available.
Client certificate authentication bypass in Traefik v3.7.0-v3.7.10 allows unauthenticated network clients to reach services protected by the nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" annotation without presenting a valid mTLS client certificate. The flaw stems from a naming collision in the Kubernetes Ingress NGINX provider: when two Ingress objects share the same host, client CA secret, and authentication mode, Traefik's conflict-resolution logic silently falls back to the entry point's default TLS configuration, which imposes no client certificate requirement. No public exploit has been identified at time of analysis, and the issue is fixed in Traefik v3.7.11.
Traefik's Kubernetes Ingress provider, starting from v3.7.1, incorrectly fails to enforce crossProviderNamespaces namespace-isolation controls on the traefik.ingress.kubernetes.io/service.middlewares Service annotation. A low-privileged tenant scoped to their own Kubernetes namespace can attach an operator-owned middleware from a namespace they are not permitted to reference, and if that middleware injects authentication credentials into backend requests, the attacker can exfiltrate those credentials via a backend endpoint under their control. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Shell command injection in Nuclio's Dashboard build pipeline (versions 1.6.19–1.17.1) allows an authenticated user with function-create permission to execute arbitrary commands inside the Dashboard container by embedding shell metacharacters in the `spec.build.tempDir` field. The post-exploitation impact is substantially amplified because the Dashboard container's Kubernetes service account holds wildcard access to Secrets, Pods, Jobs, and Deployments within its namespace, enabling full namespace-level privilege escalation from a single low-privileged API call. No public exploit identified at time of analysis, but the fix commit (PR #4190) includes working proof-of-concept test cases demonstrating semicolon, pipe, subshell, and backtick injection payloads.
Annotation injection in F5 NGINX Ingress Controller allows any authenticated Kubernetes principal with write access to Ingress resources to embed arbitrary NGINX configuration directives through unsanitized annotation fields. The configuration generator passes multiple user-controllable annotation values directly into the generated nginx.conf without sanitization, enabling an attacker to inject directives that create or delete files, disable services, or manipulate NGINX routing behavior. Impact is confined to the Kubernetes control plane; the NGINX data plane itself is not directly reachable through this vulnerability.
Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.
Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.
Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `bufferAllocLimit` DoS mitigation via two unwrapped allocation paths - `Buffer.concat(list, totalLength)` and `Buffer.from({length: N})` - committing unbounded host external memory in a single synchronous C++ call that V8's timeout mechanism cannot interrupt. A publicly available PoC confirms that a 200-byte sandbox payload inflates host RSS by hundreds of megabytes per invocation, making a single crafted request sufficient to OOM-kill a host process running inside a Docker container, Kubernetes pod, or AWS Lambda function. No public exploit identified in CISA KEV at time of analysis, though functional exploit code is embedded in the GHSA advisory itself.
Server-side request forgery in Budibase automation steps (all versions prior to 3.41.3) exposes internal network resources - including cloud metadata endpoints, private databases, and Kubernetes APIs - to any authenticated user with automation creation rights. Five automation step types (outgoing webhook, Zapier, n8n, Slack, Discord) invoke node-fetch directly without any IP validation, completely bypassing the blacklist module that guards only the REST API integration. A second compounding flaw causes the REST API blacklist to default to an empty allowlist when the BLACKLIST_IPS environment variable is unset, meaning default Budibase deployments carry zero SSRF protection across all outbound request vectors. No CISA KEV listing exists, but the GHSA advisory provides source-level code references that substantially document the attack surface.
Missing authentication on OpenChoreo's cluster-gateway (before 1.0.2 and 1.1.2) exposed caller-facing management APIs on the same externally reachable listener used for agent WebSocket traffic, letting network-reachable attackers hit /api/proxy/ and /api/exec/ without any credentials. In multi-cluster deployments this permits proxying the data-plane Kubernetes API and executing commands inside workload pods, effectively yielding cross-cluster control. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-qh9r-j7rp-4x2m) and CVSS 9.6 mark it as critical.
Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; risk is amplified because the internal listener effectively brokers cross-tenant, multi-cluster control-plane access.
Authorization bypass in OpenChoreo's Kubernetes developer platform allows any authenticated user with a project-scoped grant to execute commands in and exfiltrate wirelogs from components belonging to entirely different projects within the same namespace. The root cause is that the `component:exec` and `wirelogs:view` API handlers in `exec.go` and `wirelogs.go` evaluate authorization using the attacker-controlled `project` query parameter rather than the authoritative `comp.Spec.Owner.ProjectName` field - a textbook CWE-639 insecure direct object reference. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 score and low-privilege network exploitation path make this a serious cross-tenant isolation failure in multi-project deployments.
OS command injection in OpenChoreo's Workflow Plane templates allows authenticated developers to execute arbitrary shell commands inside workflow pods by supplying malicious workflow parameters. Affected versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2 directly interpolated user-controlled parameters such as image-name, image-tag, app-path, and build-env into sh -c shell text rather than passing them through container.env, a classic CWE-78 pattern. Compounding the injection risk, affected privileged Podman templates lacked the hostUsers: false isolation setting, creating a credible path from workflow pod compromise to Kubernetes node-level impact. No public exploit has been identified at time of analysis, but the fix commits confirm the vulnerability mechanism.
Unauthenticated API access in OpenChoreo's Backstage backend exposes all `/api/*` routes to any network-reachable attacker, enabling catalog enumeration, scaffolder log reads, and catalog location creation or deletion without credentials. The root cause is two Backstage safety flags - `dangerouslyDisableDefaultAuthPolicy` and `dangerouslyAllowOutsideDevelopment` - hardcoded to `true` in both `app-config.yaml` and `app-config.production.yaml`, effectively disabling Backstage's authentication layer in all pre-fix deployments. No public exploit identified at time of analysis; vendor-released patches are available at v1.0.4, v1.1.4, and v1.2.1.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.
Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.
Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. No public exploit is identified at time of analysis, but the flaw is fixed in 5.36.0 and carries a critical 9.9 CVSS.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.
Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.
Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.
Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.
Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.
Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.
Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.
Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.
Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. 'a-b' vs 'a_b') were assigned identical datastore identifiers and silently shared backing storage. No public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor advisory (GHSA-4f3f-65vx-r34f) and the fixing commit, which now uses the immutable resource UID.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. record_transformer records) into the config without escaping newlines, an attacker injects a `<match **>` block using the core `@type exec` plugin to run arbitrary commands. A working proof-of-concept is published in the GitHub advisory (GHSA-mjqf-28ph-426h); publicly available exploit code exists, but there is no CISA KEV listing indicating active exploitation.
Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. This is a missing-authorization (CWE-862) flaw reported by Kong; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. Reported by Kong; no public exploit identified at time of analysis and not listed in CISA KEV.
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
Complete cluster compromise via missing authentication in Microsoft Azure Kubernetes Service allows any unauthenticated remote attacker to gain administrative privileges over the network. No user interaction is required, and the vulnerability is automatable, enabling full cluster takeover with potential cross-tenant impact. No public exploit code or active exploitation has been reported, and a vendor patch is available.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.
Improper authorization in cert-manager 1.18.0 through 1.19.5 and 1.20.0-1.20.2 lets a namespaced tenant with standard Challenge/Order create rights forge ACME Challenge resources that reference a ClusterIssuer, bypassing DNS01 solver selectors (dnsZones, dnsNames, matchLabels) so the controller uses cluster-wide DNS credentials for attacker-chosen provider settings and names. The primary consequence is disclosure of shared ClusterIssuer DNS credentials - notably acme-dns X-Api-User and X-Api-Key headers - enabling cross-tenant credential theft in multi-tenant clusters. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass and control-plane information disclosure in Envoy Gateway (versions >= 1.8.0-rc.0 to < 1.8.1, and all releases < 1.7.4) allows any in-cluster pod that can reach the xDS gRPC server on port 18000 to read sensitive xDS resources without valid credentials. The flaw affects only deployments running in GatewayNamespaceMode, where the JWT StreamInterceptor mishandles State-of-the-World DiscoveryRequests and no UnaryInterceptor guards the Fetch endpoints, exposing TLS private keys (SDS), clusters/endpoints, and routing configuration. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 7.4 (High).
Arbitrary file disclosure in Envoy Gateway's controller allows a low-privileged tenant who can create an EnvoyExtensionPolicy to read sensitive files from the gateway controller pod. A path-normalization gap in the security.lua critical-path check (CWE-20) lets attacker-supplied Lua bypass the read restriction using double-slash paths (e.g. //etc/passwd), exposing Kubernetes service-account tokens, TLS certificates, and process environment. No public exploit identified at time of analysis, but the vendor advisory documents the exact bypass and CVSS is rated 9.1.
Privilege escalation in Argo Workflows before 3.7.15 and 4.0.6 lets a low-privileged user who can submit Workflows bypass the Strict/Secure templateReferencing protections and inject an arbitrary strategic-merge PodSpecPatch into the artifact garbage-collection pod. Because the fix for CVE-2026-31892 only walked top-level WorkflowSpec fields and allow-listed WorkflowSpec.ArtifactGC wholesale, its nested WorkflowLevelArtifactGC.PodSpecPatch flowed unmodified into util.ApplyPodSpecPatch, allowing an attacker to spawn a pod with privileged: true, hostPath volumes, hostNetwork: true, and an attacker-chosen image and command. This is an incomplete-fix regression; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Configuration injection in F5 NGINX Ingress Controller lets an authenticated Kubernetes user with rights to create or modify Ingress CRDs or annotations smuggle arbitrary NGINX directives into the generated configuration. Because multiple user-controllable fields are written to the config without sanitization, an attacker can inject directives that create or delete files and disable services on the control plane. No public exploit identified at time of analysis; this is a control-plane-only issue with no data plane exposure, but the CVSS 4.0 score of 8.7 (High) reflects strong confidentiality and integrity impact.
Privilege escalation in Woodpecker CI (v1.0.0 through v3.15.0) running the Kubernetes backend lets any user with Push permission on a connected repository set the pipeline pod's serviceAccountName to an arbitrary ServiceAccount in the pipeline namespace, inheriting its RBAC rights. Because the option was passed straight to the pod spec with no admin gating, a low-privilege contributor can pivot to a privileged ServiceAccount and exfiltrate secrets (DB credentials, API keys, TLS certs) or take over the cluster. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is available in v3.16.0 via a default-off gating flag.
Unauthenticated remote denial of service in StacklokLabs MKP (Model Context Protocol for Kubernetes) server versions before 0.4.1 lets a single crafted `tools/call` request against the default `:8080` endpoint exhaust process memory. The `get_resource` tool accepts attacker-controlled `limitBytes`/`tailLines` values with no upper bound and streams the entire Kubernetes pod-log response into an in-memory `bytes.Buffer`, driving an OOM kill (dynamic reproduction grew RSS from 25.8 MB to 1,179.3 MB on one request). Publicly available exploit code exists in the GitHub Security Advisory; there is no public evidence of active exploitation.
Unauthenticated arbitrary file write in OpenCost (all versions up to and including releases before 1.119.1) lets remote clients POST to the /serviceKey endpoint and overwrite the GCP service account key file (key.json) with attacker-controlled content, with no authentication and no input validation. An attacker can either corrupt the credential file to break GCP cost collection or inject their own valid service-account key to redirect the target's billing/cost data to an attacker-owned GCP project. Publicly available exploit code exists (a full reproducible PoC is in the GHSA advisory); no public evidence of active exploitation and no CISA KEV listing.
Information disclosure with integrity impact in the Spotfire Server modules of Spotfire Enterprise, Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes allows a remote, unauthenticated attacker to obtain sensitive data and alter server-side state once a victim is lured into a passive interaction (UI:P), such as opening a crafted link or analysis. The CVSS 4.0 base score is 8.7 (High) with high confidentiality and integrity impact and low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Remote code execution in the Argo CD repo-server component (as shipped in Red Hat OpenShift GitOps and the argoproj argo-helm chart) allows an unauthenticated attacker with network access to the repo-server to run arbitrary code and, under certain conditions, poison cached manifests to push malicious Kubernetes resources into managed clusters, enabling full cluster takeover. The root cause is missing authentication (CWE-306) on a critical internal service that the default Helm chart left network-exposed. There is no public exploit identified at time of analysis, but detailed third-party technical research (Synacktiv) and press coverage exist, and the flaw was reported unpatched at disclosure.
Argument injection in Flux159 MCP Server Kubernetes before 3.9.0 lets remote attackers redirect kubectl operations to an attacker-controlled API server by smuggling a leading-dash `--server` flag through the resourceType and name parameters of the kubectl_get, kubectl_describe, and kubectl_delete structured tools. Because the injected values bypass the assertNoDangerousFlags check, the operator's bearer token is transmitted to the external server, enabling full Kubernetes cluster compromise. Reported by VulnCheck, it carries CVSS 4.0 9.3, has publicly available exploit code, and a vendor patch in release 3.9.0; there is no confirmed active exploitation.
Server-Side Request Forgery in the guardrails-detectors component allows a remote attacker to submit a crafted XML Schema Definition (XSD) that forces the service to make attacker-directed requests, reaching cloud metadata services, the Kubernetes API, internal MinIO object storage, and other internal endpoints, and to read local files such as service account tokens and pod secrets. Because the flaw is blind SSRF chained to local file disclosure inside a container/Kubernetes context, an attacker can harvest credentials and pivot deeper into the cluster. No public exploit identified at time of analysis, but the CVSS 9.3 rating and scope-changing impact make this high priority for affected AI-guardrails deployments.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Memory-exhaustion denial of service in soupsieve, the CSS selector engine bundled with Beautiful Soup 4 (beautifulsoup4), lets remote unauthenticated attackers crash Python services by submitting a large comma-separated CSS selector to soupsieve.compile() or Beautiful Soup's .select()/.select_one(). Each comma-delimited item is parsed into a ~976-byte object graph with no cap on list length, so a ~500 KB selector string of 'a,a,a,...' expands to roughly 244 MB of heap (a ~488x amplification), triggering OOM kills or MemoryError. A working proof-of-concept is published in the advisory; no CISA KEV listing or in-the-wild exploitation is reported.
Remote code execution in Nuclio's Kubernetes cron-trigger implementation allows an attacker who can submit a NuclioFunction specification to inject arbitrary shell commands that execute inside CronJob pods running as root. Two unsanitized paths exist: header keys are interpolated verbatim inside double-quoted shell arguments (breaking quoting context), and event bodies processed with Go's strconv.Quote survive as unescaped `$()` command substitution sequences. Both paths were dynamically verified on the latest release (1.15.27), and the resulting CronJobs persist as orphaned resources even after function deletion because they carry no ownerReferences. A publicly available PoC with full reproduction steps exists per the GHSA advisory. No KEV listing at time of analysis.
Authentication bypass in Portainer Community Edition (2.39.0-2.39.3 and 2.40.0 through 2.42.x) lets an unauthenticated network attacker seize full administrative control of a freshly deployed, uninitialized instance. During the five-minute post-deployment setup window the /api/restore and /api/users/admin/init endpoints stay reachable without credentials, so an attacker who wins the race can create the first admin account or restore a crafted backup and take over the platform along with every Docker, Swarm, Kubernetes and ACI environment it manages. No public exploit identified at time of analysis and it is not on CISA KEV, but the fix is available in 2.39.4 and 2.43.0.
Missing authentication in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes deployments) exposes a critical API endpoint that a remote, unauthenticated attacker can reach directly, bypassing access controls to interact with functionality that should require an authenticated session. Esri rates this critical (CVSS 9.8) and disclosed it in its June 2026 ArcGIS security bulletin; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the exposed function is an administrative/portal API reachable over the network with no credentials, successful access could lead to disclosure or manipulation of portal content and configuration.
Account takeover in Esri Portal for ArcGIS 12.1 and earlier (Windows, Linux, and Kubernetes) stems from a weak forgotten-password recovery mechanism (CWE-640) that a remote, unauthenticated attacker can manipulate to assume ownership of another user's account. The flaw carries a CVSS 9.8 rating because it is network-reachable with no authentication or user interaction, yielding full compromise of confidentiality, integrity, and availability of the targeted account. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), and CISA's SSVC framework records exploitation as none, indicating no observed in-the-wild activity despite the critical score.
Authenticated denial of service in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4 allows any user holding a valid API token to exhaust Central's resources. Because Central does not cap the nesting depth of queries served on its authenticated GraphQL API, a single deeply nested query can drive excessive CPU and memory consumption and take down the RHACS management plane. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low-privilege network vector makes it trivial for any token holder to trigger.
Arbitrary CWD-file read and inode-tampering in the oras-go v2 content/file tar extractor allows an attacker who controls an OCI artifact to hardlink files from the pulling process's working directory into the extract tree. When a victim runs 'oras pull' (or any Go program using oras-go/v2/content/file) against a malicious layer marked with the io.deis.oras.content.unpack annotation, the flawed ensureLinkPath helper validates a resolved hardlink target but passes the original relative Linkname to os.Link, causing link(2) to resolve it against the process CWD instead of the extract base. Publicly available exploit code exists (detailed PoC and regression test in the advisory); this is not listed in CISA KEV and no active exploitation is confirmed.
Privilege-escalation via admission-control bypass in Rancher Fleet allows an attacker with git push access to a Fleet-monitored repository to overwrite Pod Security Standards (PSS) enforcement labels on target namespaces. Because Fleet's agent-side deployer failed to filter security-sensitive keys (notably the `pod-security.kubernetes.io/` prefix) from `namespaceLabels` in `fleet.yaml` or `BundleDeployment.spec.options.namespaceLabels`, an attacker can downgrade namespace admission enforcement and deploy privileged or otherwise restricted workloads that PSS would normally block. No public exploit identified at time of analysis; the flaw was privately reported through responsible disclosure by a NATO NCSC researcher and is not listed in CISA KEV.
Server-Side Request Forgery in Sigstore Fulcio (before v1.8.6) lets a compromised or malicious OIDC issuer redirect the OIDC Discovery client's metadata fetches to attacker-chosen hosts, enabling blind SSRF against internal systems, poisoning of the verifier cache via a substituted jwks_uri so forged signatures validate, and leakage of the in-cluster Kubernetes ServiceAccount token to third-party hosts. Unauthenticated remote attackers who control a configured (or wildcard-matched) issuer can chain these into trust compromise of the certificate authority. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in SUSE Rancher's in-cluster admission webhook (rancher-webhook) lets a network-adjacent, unauthenticated attacker forge FleetWorkspace admission payloads so that workspace-related Kubernetes objects are created with attacker-chosen identity data. Affected releases span Rancher 0.7.0–0.7.10, 0.8.0–0.8.7, 0.9.0–0.9.6 and 0.10.0–0.10.7, with integrity impact but no direct confidentiality or availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is documented in SUSE/Rancher advisory GHSA-h83p-cq95-vph4.
Offline administrator password recovery in Kestra OSS (versions prior to 1.3.24) stems from its BasicAuth component storing the admin credential as a fast SHA-512 hash. An attacker who already holds read access to the backing PostgreSQL database can extract that hash and crack it offline at high speed, then log in as administrator; in Kubernetes deployments this further exposes the cluster ServiceAccount token and all K8s Secrets, enabling vertical privilege escalation. No public exploit identified at time of analysis and not on CISA KEV; EPSS data was not provided.
Denial of service in the Linux kernel's WireGuard module causes the receive/decryption path to permanently stall for an individual peer under heavy network load. Affected stable trees (notably 6.12.34 through 6.12.73, with the same defect originating in 5.15/6.1 where threaded NAPI became default) can have inbound traffic to a specific WireGuard peer halt completely once the per-peer rx_queue fills its 1024-packet backlog and wg_packet_rx_poll is never rescheduled. The condition was reported by multiple production Cilium/Kubernetes operators; there is no public exploit identified at time of analysis and EPSS is very low (0.10%, 1st percentile).
Server-side request forgery in Budibase (@budibase/backend-core before 3.39.9) lets authenticated users with automation permissions bypass the SSRF blacklist via DNS rebinding, reaching loopback, RFC1918, and cloud metadata endpoints from the Budibase host. The outbound fetch helper validates a hostname's resolved IP against the blacklist but never pins that IP to the subsequent socket, so node-fetch performs a second DNS lookup that can resolve to an internal address. Because several automation steps return upstream response bodies into automation output, the result is a non-blind read primitive; publicly available exploit code (a rebinding PoC) exists, though EPSS is low (0.24%, 15th percentile) and it is not on CISA KEV.
Cross-origin data exposure in Glances XML-RPC server (versions 4.5.3 through 4.5.4) allows any malicious web page to read full system monitoring data from a victim's browser because the CORS allowlist silently collapses to 'Access-Control-Allow-Origin: *' whenever two or more origins are configured. This is an incomplete fix for CVE-2026-33533: the CORS header is computed once at startup and never validated against the request's Origin. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis as actively exploited.
Kubernetes device-plugin and resource-allocation enforcement can be bypassed in containerd by a namespace user holding pod-creation rights, who restores a container from a maliciously crafted checkpoint image. The CRI restore path trusts Container Device Interface (CDI) annotations embedded in untrusted checkpoint metadata instead of the pod's create-time spec, letting the attacker smuggle arbitrary CDI edits (host device nodes and mounts) into the restored container. It affects containerd v2.1.0-2.1.8, v2.2.0-2.2.4 and v2.3.0-2.3.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Mutual-TLS bypass in Traefik v3.7.0 and v3.7.1 lets unauthenticated remote attackers reach backends protected by wildcard-router `TLSOptions` (for example `Host("*.example.com")` with `RequireAndVerifyClientCert`). The `SNICheck` domain-fronting middleware resolves TLS options for the HTTP `Host` header via exact map lookups only, so an attacker completing the TLS handshake under a permissive SNI on the same entrypoint can then send a `Host` header for the wildcard-protected backend and skip the client-certificate requirement. Publicly available exploit code exists in the GitHub Security Advisory PoC; this is independent of the prior HTTP/3 mTLS issue.
Cross-tenant container deletion in the Radius Kubernetes controller (versions <= v0.57.1) allows a tenant with Deployment annotation-edit rights to coerce the high-privilege controller into deleting another tenant's container resource by injecting a forged radapp.io/status JSON blob. The flaw is a classic Confused Deputy (CWE-441/CWE-20) that yields an availability-only impact, is most severe in multi-tenant installs, and currently has publicly available exploit code via the GHSA advisory but no public exploit identified at time of analysis in CISA KEV.
Privilege escalation in Fission (Kubernetes-native serverless framework) prior to version 1.25.0 allows a tenant with permission to create Function or Environment CRDs to obtain CAP_SYS_TIME inside function/runtime containers by bypassing an incomplete capability denylist in the ValidatePodSpecSafety admission webhook. The denylist only blocked six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE) and omitted CAP_SYS_TIME and others, letting tenant-controlled code modify the container's system clock. No public exploit identified at time of analysis, but the upstream patch and CRD diff are publicly visible in fission/fission PR #3465.
Path traversal in Fission Kubernetes serverless framework prior to version 1.25.0 allows authenticated tenants to write files outside the intended extraction directory by submitting a crafted package archive. The fetcher sidecar (fission-fetcher) processes attacker-controlled Package.Spec.Source.URL or Deployment.URL archives via Unarchive in pkg/utils/zip.go, where filepath.Join was used without verifying the resolved path stayed under the destination, enabling cross-tenant file overwrite, tampering with mounted secret/config volumes, or overwriting the fetcher binary itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.