Kubernetes

Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.

SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.

Unbounded symlink-following in KubeVela's Terraform remote configuration loader allows any principal with `ComponentDefinition` create/update RBAC rights to OOM-kill the cluster-wide vela-core controller and halt all OAM application reconciliation. The root cause (CWE-59) is that `GetTerraformConfigurationFromRemote` in `pkg/controller/utils/capability.go` calls `os.ReadFile` on a symlink target without verifying the target is a regular file or bounding the read size; a repository containing `variables.tf -> /dev/zero` is sufficient to exhaust controller memory before HCL parsing is ever reached. No CISA KEV listing has been identified at time of analysis, but a complete proof-of-concept with exact reproduction commands is publicly disclosed in GHSA-fmgp-q6jx-gg3x, materially lowering the exploitation bar.

Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.

Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.

Cross-cluster authorization bypass in KubePi 2.0.0 and earlier permits an authenticated user with management rights over one Kubernetes cluster to read or modify data in other clusters they were not granted access to. The cluster identifier passed in API request URLs is trusted without per-request validation against the calling user's cluster bindings, confirmed by the patch introducing `requireClusterAccess()` middleware across chart and cluster API handlers. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 subsequent-system impact (SC:H/SI:H/SA:H) reflects that successful exploitation grants high-impact lateral access across the full multi-cluster estate managed by the panel.

Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.

Cross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes on Kubernetes clusters belonging to other tenants, affecting versions 4.21.0.0 through 4.22.1.0. The improper access control breaks tenant isolation in a multi-tenant IaaS platform, enabling unauthorized integrity and confidentiality impact against neighboring tenants' clusters. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile) despite the 9.1 CVSS.

Privilege escalation to PostgreSQL superuser and pod-level command execution in CloudNativePG before 1.28.4 and 1.29.2 lets a low-privileged tenant who holds DATABASE OWNER escape from database-level control to the postgres OS process. Because operator-issued superuser connections did not pin search_path, a tenant could plant overloaded built-in operators in the public schema and hijack instance-manager introspection queries so they run attacker-controlled code as the superuser, then reach OS command execution via COPY ... FROM PROGRAM and the pod's ServiceAccount token. This is CWE-426 (Untrusted Search Path), the same class as PostgreSQL's CVE-2018-1058; no public exploit identified at time of analysis, but the vendor patch and detailed advisory make the mechanism fully documented.

Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.

Cross-cluster MITM attacks are enabled in Red Hat Advanced Cluster Management for Kubernetes 2.x via the lighthouse service discovery component, which fails to validate IP addresses advertised in EndpointSlice objects. An attacker controlling a compromised spoke cluster can inject arbitrary IP addresses into EndpointSlices, causing lighthouse DNS resolution across all connected clusters to redirect legitimate cross-cluster service traffic to attacker-controlled endpoints. The CVSS Scope:Changed metric confirms that impact propagates beyond the compromised spoke cluster to the hub and peer clusters, enabling unauthorized interception and manipulation of inter-cluster communications. No public exploit code or CISA KEV listing has been identified at time of analysis.

Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).

Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.x allows a cluster administrator-or any user holding RBAC permissions to modify the Submariner Custom Resource-to reference an unvalidated, attacker-controlled container image path, causing the operator to deploy and execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes. The root cause (CWE-20: Improper Input Validation) is the absence of image path sanitization or verification before the operator acts on the Submariner CR field, enabling privilege escalation beyond the user's intended cluster boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the Changed Scope with full C:H/I:H/A:H impact ratings signal potential for complete cluster compromise once the high-privilege prerequisite is met.

Cleartext storage of the IPsec pre-shared key (PSK) in the Submariner Custom Resource exposes the cryptographic secret used to secure all inter-cluster communication in Red Hat Advanced Cluster Management for Kubernetes 2 deployments. Any principal with low-privilege read access to the Submariner CR object within the Kubernetes cluster can retrieve the PSK and use it to passively decrypt IPsec-encrypted traffic flowing between every cluster in the connected mesh - not just the cluster where access was obtained (CVSS scope change S:C). No public exploit code exists and the vulnerability is not listed in CISA KEV, but the architectural impact is severe: a single stolen key compromises the confidentiality of all inter-cluster traffic simultaneously.

Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.

Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.

Credential exposure in Red Hat Advanced Cluster Management for Kubernetes 2.x allows any local user with access to a must-gather diagnostic archive to read proxy basic-auth credentials in plaintext. The must-gather component dumps the cluster Proxy object in raw form, bypassing the redaction logic that oc inspect would normally apply to sanitize sensitive fields before archiving. No public exploit code exists and this is not listed in CISA KEV, but the CVSS AV:L/PR:L vector confirms real-world exposure is bounded to archive access rather than remote exploitation.

Cleartext credential exposure in Red Hat Advanced Cluster Management for Kubernetes affects the must-gather diagnostic tool, which collects ACM wrapper Custom Resources containing embedded Secret data without scrubbing sensitive fields. Any administrator who runs must-gather to diagnose cluster issues inadvertently captures credentials and tokens in the resulting archive, which may then be stored, shared, or transmitted without awareness of the embedded secrets. No public exploit identified at time of analysis, but the information disclosure risk is compounded by the routine, trust-assumed nature of diagnostic archive handling.

Denial-of-service in vm2 (Node.js sandbox library) versions 3.11.0-3.11.5 allows sandbox code to bypass the `bufferAllocLimit` DoS mitigation via two unwrapped allocation paths - `Buffer.concat(list, totalLength)` and `Buffer.from({length: N})` - committing unbounded host external memory in a single synchronous C++ call that V8's timeout mechanism cannot interrupt. A publicly available PoC confirms that a 200-byte sandbox payload inflates host RSS by hundreds of megabytes per invocation, making a single crafted request sufficient to OOM-kill a host process running inside a Docker container, Kubernetes pod, or AWS Lambda function. No public exploit identified in CISA KEV at time of analysis, though functional exploit code is embedded in the GHSA advisory itself.

Server-side request forgery in Budibase automation steps (all versions prior to 3.41.3) exposes internal network resources - including cloud metadata endpoints, private databases, and Kubernetes APIs - to any authenticated user with automation creation rights. Five automation step types (outgoing webhook, Zapier, n8n, Slack, Discord) invoke node-fetch directly without any IP validation, completely bypassing the blacklist module that guards only the REST API integration. A second compounding flaw causes the REST API blacklist to default to an empty allowlist when the BLACKLIST_IPS environment variable is unset, meaning default Budibase deployments carry zero SSRF protection across all outbound request vectors. No CISA KEV listing exists, but the GHSA advisory provides source-level code references that substantially document the attack surface.

Missing authentication on OpenChoreo's cluster-gateway (before 1.0.2 and 1.1.2) exposed caller-facing management APIs on the same externally reachable listener used for agent WebSocket traffic, letting network-reachable attackers hit /api/proxy/ and /api/exec/ without any credentials. In multi-cluster deployments this permits proxying the data-plane Kubernetes API and executing commands inside workload pods, effectively yielding cross-cluster control. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-qh9r-j7rp-4x2m) and CVSS 9.6 mark it as critical.

Missing authentication in OpenChoreo's cluster-gateway internal API lets any network-reachable caller invoke /api/proxy/, /api/exec/, and /api/wirelogs/ without a client certificate or token, exposing tenant Kubernetes Secrets and allowing workload mutation and arbitrary command execution across every connected data plane. All deployments before 1.0.3, 1.1.3, and 1.2.0-rc.2 are affected, and the fix introduces an opt-in --internal-mtls mode plus a dedicated internal CA. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; risk is amplified because the internal listener effectively brokers cross-tenant, multi-cluster control-plane access.

Authorization bypass in OpenChoreo's Kubernetes developer platform allows any authenticated user with a project-scoped grant to execute commands in and exfiltrate wirelogs from components belonging to entirely different projects within the same namespace. The root cause is that the `component:exec` and `wirelogs:view` API handlers in `exec.go` and `wirelogs.go` evaluate authorization using the attacker-controlled `project` query parameter rather than the authoritative `comp.Spec.Owner.ProjectName` field - a textbook CWE-639 insecure direct object reference. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 score and low-privilege network exploitation path make this a serious cross-tenant isolation failure in multi-project deployments.

Unauthenticated build triggering in OpenChoreo before v1.0.3, v1.1.3, and v1.2.0-rc.2 allows any remote attacker to fire CI/CD pipeline jobs without valid webhook credentials. The POST /api/v1alpha1/autobuild endpoint trusts the caller-controlled X-Event-Key header to select a webhook provider and does not enforce HMAC-SHA256 validation for Bitbucket events, permitting cross-provider spoofing and build triggers using attacker-supplied commit SHAs against any matched repository and branch. No public exploit is identified at time of analysis, and vendor-confirmed patches exist for all affected release lines.

OS command injection in OpenChoreo's Workflow Plane templates allows authenticated developers to execute arbitrary shell commands inside workflow pods by supplying malicious workflow parameters. Affected versions prior to 1.0.4, 1.1.4, and 1.2.0-rc.2 directly interpolated user-controlled parameters such as image-name, image-tag, app-path, and build-env into sh -c shell text rather than passing them through container.env, a classic CWE-78 pattern. Compounding the injection risk, affected privileged Podman templates lacked the hostUsers: false isolation setting, creating a credible path from workflow pod compromise to Kubernetes node-level impact. No public exploit has been identified at time of analysis, but the fix commits confirm the vulnerability mechanism.

Unauthenticated API access in OpenChoreo's Backstage backend exposes all `/api/*` routes to any network-reachable attacker, enabling catalog enumeration, scaffolder log reads, and catalog location creation or deletion without credentials. The root cause is two Backstage safety flags - `dangerouslyDisableDefaultAuthPolicy` and `dangerouslyAllowOutsideDevelopment` - hardcoded to `true` in both `app-config.yaml` and `app-config.production.yaml`, effectively disabling Backstage's authentication layer in all pre-fix deployments. No public exploit identified at time of analysis; vendor-released patches are available at v1.0.4, v1.1.4, and v1.2.1.

Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.

Cross-namespace secret exfiltration in the Elastic Cloud on Kubernetes (ECK) operator allows any low-privileged Kubernetes tenant to read secrets from arbitrary namespaces cluster-wide. The operator's reconciliation loop blindly trusts namespace references embedded in secret annotations without verifying whether the requesting user is authorized to access the referenced namespace, enabling a classic confused-deputy (CWE-441) privilege escalation that breaks Kubernetes RBAC namespace isolation. No public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a material priority for any multi-tenant Kubernetes deployment running ECK; vendor-released patch version 3.5.0 is available per ESA-2026-121.

Cleartext token exposure in Elastic Cloud on Kubernetes allows any principal with namespace workload-spec read access to retrieve live Elasticsearch service account credentials. Affected deployments are those running Fleet Server resources configured to authenticate to Elasticsearch via service account tokens - ECK writes the token directly into the generated Pod specification in cleartext rather than referencing the Kubernetes Secret where other credentials are stored, bypassing an intentional RBAC boundary. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the confidentiality impact is high given that the exposed credential grants direct Elasticsearch data-plane access.

Predictable temporary file paths in Etherpad's import and export handlers expose multi-tenant deployments to a symlink-based file overwrite attack. All ep_etherpad-lite versions through v3.0.0 are affected; exploitation requires local host access, an unprivileged OS account, and - for high-impact scenarios - the Etherpad process running as root, a common default in many Docker base images. A proof-of-concept sketch is included in the vendor advisory GHSA-2jwf-f4xq-f24h; no public weaponized exploit code beyond that sketch exists and this vulnerability is not listed in the CISA KEV catalog.

Memory exhaustion in etcd's TLS acceptor loop allows unauthenticated network attackers to crash etcd clusters - and the Kubernetes control planes they back - without completing a TLS handshake. The vulnerable code path in `client/pkg/transport/listener_tls.go` spawns a goroutine per inbound TCP connection with no timeout, meaning connections that never send a ClientHello block indefinitely inside `tls.Conn.Handshake()` and accumulate in an unbounded `pending` map. Exploitation is trivially automatable: no special protocol knowledge is needed beyond initiating TCP connections. No public exploit code or CISA KEV listing exists at time of analysis, but the Kubernetes control plane dependency elevates real-world blast radius well beyond a standalone etcd outage.

Insecure Direct Object Reference in Microsoft Container Migration Solution Accelerator version 2.1.2 and earlier enables any authenticated organization member to read, overwrite, and delete migration processes and files belonging to other users within the same tenant. The application delegates identity verification to Entra ID but implements no per-resource ownership checks across its process and file management API endpoints, meaning the authentication boundary is entirely decoupled from the authorization boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full confidentiality, integrity, and availability impact on application data make this a high-priority remediation target for any multi-user deployment.

Authenticated command injection in Prowler (Cloud/API) before 5.36.0 lets a low-privileged user with provider-management access run arbitrary shell commands on the shared backend worker. The Kubernetes provider's connection test accepted a kubeconfig containing a legacy GCP auth-provider with cmd-path/cmd-args, which the kubernetes-python client executed via subprocess when POST /api/v1/providers/{id}/connection loaded it. No public exploit is identified at time of analysis, but the flaw is fixed in 5.36.0 and carries a critical 9.9 CVSS.

Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.

Privilege escalation in Intel's Cluster Management Toolkit for Kubernetes (CMK) before v0.8.5 allows a privileged local adversary to fully compromise the confidentiality, integrity, and availability of the affected system by exploiting a protection mechanism failure (CWE-693) within the Ring 3 user-application boundary. Exploitation requires a pre-established privileged local account, specific attack prerequisites (AT:P), and the occurrence of passive user interaction - a combination that substantially limits the exploitable population but results in complete system-level impact when conditions align. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Privilege escalation in Red Hat OpenShift AI's training-operator enables any user holding a standard Kubernetes edit or admin role in any cluster namespace to break out of namespace isolation, impersonate service accounts, access the host filesystem, and achieve remote code execution. The root cause is a design flaw: the operator aggregates training job permissions onto native Kubernetes built-in ClusterRoles, and allows unrestricted PodTemplateSpec passthrough - meaning users can submit training jobs containing arbitrary pod configurations such as hostPath mounts or elevated service account tokens. No public exploit code or CISA KEV listing was identified at time of analysis, but the low access complexity and the broad availability of edit/admin roles in typical ML platform deployments make this an urgent remediation priority.

Privilege escalation in Red Hat OpenShift AI (RHOAI) training operator overlay allows any namespace editor to manage TrainJob resources beyond their intended authorization scope. The RHOAI overlay incorrectly injects trainjobs CRUD permissions into the native Kubernetes edit ClusterRole, violating the principle of least privilege. When chained with a companion flaw (TRN-01) that permits arbitrary pod configuration within TrainJobs, a remote attacker holding namespace editor credentials could escalate to arbitrary code execution - no public exploit is identified at time of analysis, and KEV listing has not been confirmed.

Code injection in the Feast operator within Red Hat OpenShift AI (RHOAI) allows an authenticated, high-privileged tenant to embed malicious code into their feature repository, which an automated operator process then executes under elevated Kubernetes RBAC permissions. Successful exploitation yields credential theft and full cluster administrative control, representing a critical privilege escalation pathway despite the moderate vendor CVSS score of 5.5. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Overprivileged ClusterRole assignments in Red Hat OpenShift AI's Data Science Pipelines Operator (DSPO) create a cluster-wide privilege escalation path if the operator pod is compromised. The DSPO ClusterRole grants capabilities well beyond operational necessity - including pod exec and cluster-wide RBAC management - directly violating the principle of least privilege (CWE-250). Successful exploitation of a compromised DSPO pod would allow an attacker to assume full administrative control over the entire Kubernetes cluster; no public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS scope-change flag (S:C) confirms the blast radius extends far beyond the initial compromise boundary.

Authentication bypass in the Models-as-a-Service (MaaS) API component of Red Hat OpenShift AI (RHOAI) lets any pod already running in the cluster impersonate arbitrary users by forging the X-MaaS-Username and X-MaaS-Group HTTP headers, which the service trusts without independent verification. Because the MaaS API performs no first-party authentication and defers entirely to a Kuadrant AuthPolicy gateway that can be circumvented, a low-privileged workload can mint Kubernetes ServiceAccount tokens in other tenants' namespaces, revoke API keys, and exfiltrate model-access configuration - a full cross-tenant privilege escalation. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.9 CVSS reflects near-total impact.

Namespace isolation bypass in Traefik's Kubernetes CRD provider allows a tenant confined by RBAC to a single namespace to bind their own router to a `TraefikService` owned by a different namespace, exposing or rerouting that namespace's backend services - defeating the isolation boundary that `allowCrossNamespace=false` (the default) is meant to enforce. All Traefik v2 releases through 2.11.53, v3.0.0-3.6.24, and v3.7.0-3.7.9 are affected; patches are available at v2.11.54, v3.6.25, and v3.7.10. A proof-of-concept test harness accompanies the advisory confirming the bypass; the vulnerability has not been added to CISA KEV at time of analysis.

Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.

Traefik's BasicAuth middleware in versions 3.6.11-3.6.24 and 3.7.0-3.7.9 permits an authenticated low-privilege user to forge arbitrary backend identities via a singleflight key collision race condition. By concatenating their known valid password with a retrieved stored bcrypt hash, an attacker crafts a singleflight deduplication key identical to a legitimate in-flight request's key; the middleware returns the legitimate request's successful authentication result to the attacker's request, then propagates the attacker's chosen unconfigured username to the backend as a trusted identity. A fully working proof-of-concept achieving 25-of-25 successful identity forgeries under default bcrypt cost is publicly available in the GitHub security advisory; no CISA KEV listing has been identified at time of analysis.

Remote command injection in livebook-dev Livebook's deployment setup command generator allows an authenticated high-privilege attacker to poison Docker and Fly.io setup commands displayed in the web interface, causing arbitrary shell code to execute on the machine of any user who copies and runs the generated command. Affected versions span 0.13.0 through 0.18.6 and 0.19.0 through 0.19.8. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 4.9 reflects the high privileges required and the indirect execution path through a secondary user's action.

Privilege escalation to cluster-admin in Red Hat Advanced Cluster Management for Kubernetes (ACM) lets a user holding only namespace-scoped 'edit' rights on an ACM hub namespace take over the entire cluster. By creating a Channel pointing to an attacker-controlled Helm repository and a Subscription referencing it, the app-subscription controller (multicluster-operators-subscription) applies the chart with its own elevated authority and without enforcing the subscription-admin role or namespace confinement, letting the chart install cluster-scoped objects such as a ClusterRoleBinding to cluster-admin. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the technical impact is total and the flaw directly contradicts ACM's documented namespace-confinement guarantee.

Privilege escalation in Red Hat's Multicluster Engine (MCE) for Kubernetes ClusterCurator controller allows a namespace-scoped tenant administrator to obtain cluster-wide administrative control. By creating a namespaced ClusterCurator resource, the tenant can cause the controller to mint an authentication token for a ServiceAccount holding cluster-admin authority, breaking tenant isolation. Rated CVSS 9.1 (scope-changed) by Red Hat; no public exploit identified at time of analysis and not listed in CISA KEV.

Server-Side Request Forgery in KubeSphere's multi-cluster controller allows any low-privileged user with Cluster CRD create or update permissions to weaponize the controller-manager and apiserver pods as HTTP proxies against arbitrary internal addresses, RFC1918 networks, and cloud instance metadata services including AWS IMDS at 169.254.169.254. The flaw resides in `pkg/utils/clusterclient/clusterclient.go` (addCluster), where the CRD-specified Kubernetes API endpoint undergoes only Go `url.Parse()` syntax validation before `Discovery().ServerVersion()` is called - no loopback, private-range, link-local, or metadata-address filtering is applied. A public researcher write-up demonstrating the attack path exists; no active exploitation has been confirmed in CISA KEV at time of analysis.

Server-side request forgery in Open WebUI (pip/open-webui versions 0.9.0 through 0.10.x) allows any authenticated low-privilege user to reach internal cloud metadata endpoints, loopback-bound admin surfaces, and VPC-internal APIs by encoding IPv4 addresses inside the NAT64 well-known prefix `64:ff9b::/96`. The SSRF filter evaluates only whether the literal IPv6 address is globally routable - which NAT64 addresses are, by design - without unwrapping the embedded IPv4 destination before deciding to allow or block the request. Full response bodies, including AWS IAM role credentials from the instance metadata service, are returned directly to the caller. A proof-of-concept exists confirming exploitation against the unmodified v0.10.2 code path; no active exploitation in the wild has been confirmed by CISA KEV at time of analysis.

Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endpoints protected by BasicAuth, DigestAuth, or ForwardAuth by exploiting unnormalized dot-segment paths generated by the Kubernetes Ingress NGINX provider's RewriteTarget middleware. When an Ingress path regex captures attacker-controlled text without requiring a path separator (e.g., /api(.*) rewriting to /$1), a crafted request such as /api../admin is rewritten to /../admin and forwarded to a backend that resolves it to /admin - a path secured on a separate Traefik router - entirely bypassing route-level access controls. No public exploit has been identified at time of analysis; a vendor patch is available in v3.7.8.

Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.

Deploy-time policy bypass in Red Hat Advanced Cluster Security for Kubernetes 4 lets a user with Kubernetes Deployment-create permission spoof workload identity by setting the openshift.io/encoded-deployment-config label to "null", forcing ACS to record the workload with empty UID, name and labels and a "default" namespace. This evades ACS deploy-time policy detection and enforcement visibility and corrupts Central's persistence, violation reporting and compliance correlation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

SQL injection via unescaped identifier interpolation in Kamaji's PostgreSQL and MySQL datastore drivers exposes the shared datastore root connection to arbitrary DDL/DML manipulation. Versions prior to 26.7.4-edge interpolate operator-supplied DataStoreUsername and DataStoreSchema fields directly into SQL via fmt.Sprintf without any identifier sanitization, allowing a quote or backtick character to break out of the identifier context. Compounding the risk, the pre-fix MySQL primary connection had multiStatements=true enabled, enabling stacked query execution over a root-privileged database connection that spans all hosted tenant control planes. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. 'a-b' vs 'a_b') were assigned identical datastore identifiers and silently shared backing storage. No public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor advisory (GHSA-4f3f-65vx-r34f) and the fixing commit, which now uses the immutable resource UID.

Privilege escalation in Capsule (Kubernetes multi-tenancy framework) versions 0.13.0-0.13.7 allows authenticated Tenant Owners to break out of tenant isolation and create cluster-scoped Kubernetes resources - including ClusterRole, ClusterRoleBinding, and ValidatingWebhookConfiguration - through the cluster-admin controller client. This is an incomplete fix of CVE-2026-22872: the TenantResource RawItems and Generators code paths (handleRawItem, handleGeneratorItem) were never updated to enforce the same cluster-scoped resource rejection guards applied to NamespacedItems. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patch v0.13.8 is available.

Capsule's node admission webhook can be crashed cluster-wide by a Cluster Admin who stores a malformed regular expression in CapsuleConfiguration's NodeMetadata fields, causing a Go panic via regexp.MustCompile that blocks all subsequent Node create, update, and patch operations. All Capsule versions prior to 0.13.8 are affected, as confirmed by GitHub Security Advisory GHSA-68cj-mvg9-rgm2. No public exploit has been identified at time of analysis, but the Scope:Changed CVSS designation reflects that the crash cascades beyond the vulnerable Capsule component to impair node admission cluster-wide.

Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. record_transformer records) into the config without escaping newlines, an attacker injects a `<match **>` block using the core `@type exec` plugin to run arbitrary commands. A working proof-of-concept is published in the GitHub advisory (GHSA-mjqf-28ph-426h); publicly available exploit code exists, but there is no CISA KEV listing indicating active exploitation.

Cluster-wide ingress denial of service in Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) lets a tenant holding only namespace-scoped Secret creation rights halt all ingress configuration changes across the entire cluster. Because the embedded KIC gathers CA-certificate Secrets from every watched namespace using only a label selector - with no ingress-class or namespace scoping - an attacker can plant a Secret whose user-controlled CA-certificate ID collides with an existing one, causing Kong Gateway to reject the whole configuration document. This is a missing-authorization (CWE-862) flaw reported by Kong; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cluster-wide ingress denial of service in Kong Kubernetes Ingress Controller (KIC) allows a tenant holding only namespace-scoped Secret creation rights to halt all ingress configuration changes across every watched namespace. Because KIC gathers CA-certificate Secrets by label selector alone - ignoring ingress-class and namespace boundaries - and derives the CA-certificate primary key from a user-supplied Secret field, a low-privileged user can create a duplicate CA-certificate ID that forces Kong Gateway to reject the entire configuration document. Reported by Kong; no public exploit identified at time of analysis and not listed in CISA KEV.

We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R

Complete cluster compromise via missing authentication in Microsoft Azure Kubernetes Service allows any unauthenticated remote attacker to gain administrative privileges over the network. No user interaction is required, and the vulnerability is automatable, enabling full cluster takeover with potential cross-tenant impact. No public exploit code or active exploitation has been reported, and a vendor patch is available.

Path traversal in the Kubernetes Java client library's copyDirectoryFromPod function allows a compromised pod to write files to arbitrary locations on the local machine of a high-privileged operator performing copy operations. The vulnerability is only reachable when enableTarCompressing is set to false, and requires both an attacker-controlled pod and an operator actively running a copy command. With a CVSS score of 2.7 (PR:H, UI:R), no public exploit, and no CISA KEV listing, this is a narrow but credible lateral-movement vector in DevOps and CI/CD operator workflows rather than a broadly exploitable flaw.

Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.

Authorization bypass in Traefik's IngressRouteTCP handler (versions 3.6.0-3.6.22 and 3.7.0-3.7.6) allows a low-privileged Kubernetes user to reference file-provider TCPServersTransport configurations across namespace boundaries that the crossProviderNamespaces allowlist should block. The allowlist was enforced for HTTP serversTransport references but silently omitted from the equivalent TCP code path, creating an inconsistent and exploitable access boundary. By crafting an IngressRouteTCP resource with serversTransport: foo@file, an attacker causes Traefik to apply privileged backend settings - including mTLS client certificates, SPIFFE workload identities, or PROXY-protocol configuration - belonging to namespaces they are not authorized to access. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patches are available in 3.6.23 and 3.7.7.

Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route author to attach unauthorized Traefik Middleware objects from foreign namespaces by exploiting incorrect namespace resolution in HTTPRoute extensionRef handling. An attacker holding an existing ReferenceGrant for a cross-namespace Service can leverage the flaw to inject trusted reverse-proxy identity headers into downstream requests - without a separate ReferenceGrant authorizing the Middleware - potentially bypassing authorization controls in backend services that trust those headers. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released fix is version 3.7.7.

Partial denial-of-service exposure in Oracle TimesTen In-Memory Database's Kubernetes Operator component (version 26.1.1.1.0) allows a low-privileged, network-authenticated attacker to degrade database availability via crafted HTTPS requests. The attack requires no user interaction and is rated easily exploitable by Oracle, though impact is limited to partial availability loss with no confidentiality or integrity effects. No public exploit code or CISA KEV listing has been identified at time of analysis.

TimesTen In-Memory Database 26.1.1.1.0 contains a medium-severity flaw in its Kubernetes Operator component, exploitable by local high-privileged attackers to gain partial unauthorized read, write, and denial-of-service capability against database data. Critically, the CVSS scope change (S:C) signals that a successful attack may cascade to additional products sharing the Kubernetes cluster, elevating the real-world blast radius beyond the individual component score. No public exploit code and no CISA KEV listing have been identified at time of analysis; Oracle confirmed the issue in the July 2026 Critical Patch Update.

Unauthorized data read in Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through the Kubernetes Operator component via HTTPS, allowing low-privileged authenticated network attackers to access a subset of database data they should not be authorized to read. The ENISA EUVD threat intelligence tags this as 'Authentication Bypass,' suggesting the Kubernetes Operator fails to enforce proper authorization controls after initial authentication, effectively allowing privilege overreach within an authenticated session. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Confidentiality breach in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged local attacker to gain complete read access to all database-accessible data through the Kubernetes Operator component via an authentication bypass. The scope-change CVSS metric indicates successful exploitation can cascade to co-located Kubernetes resources beyond the database itself. No public exploit or CISA KEV listing exists; exploitation is constrained by the requirement of local infrastructure access and high attack complexity, making this a post-compromise or insider-threat vector rather than a remote exposure.

Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.

Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows low-privileged remote attackers to crash or hang the database via crafted HTTPS requests to the Kubernetes Operator component. The vulnerability is network-accessible with low complexity, requiring only low-level credentials, and results in complete availability loss with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle has disclosed this through the July 2026 Critical Patch Update.

Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 via the Kubernetes Operator component allows a low-privileged, network-authenticated attacker to repeatedly crash or hang the database over HTTPS. The attack is classified as easily exploitable with low complexity and no user interaction required, making it a straightforward availability threat in Kubernetes-managed deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity elevates practical risk for environments where low-privileged accounts are broadly provisioned.

Privilege-escalating takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is possible through its Kubernetes Operator component, where a low-privileged attacker with network access over HTTPS can fully compromise the database. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond TimesTen itself, and its 9.9 CVSS score reflects complete confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.

Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.

Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.

Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other users' sessions across the Dashboard, Pipelines API, and Notebooks, resulting in full account and data takeover. Any user holding the kubeflow-edit/Contributor role in any namespace - a role automatically granted when Automatic Profile Creation is enabled - can abuse overly broad Istio permissions to capture the auth tokens of other UI/API users. CVSS is 8.0 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authenticated user bypass the migration URL allow/block list by supplying a permitted public Git URL that HTTP-redirects the server's git subprocess to an otherwise-blocked internal endpoint. Because Gitea validates only the originally submitted URL while git runs with its default http.followRedirects=initial, the redirected internal Git repository is cloned into an attacker-controlled repository, and pull mirrors keep re-fetching it on schedule. No public exploit identified at time of analysis; a vendor-authored local proof-of-concept confirmed the redirect is followed to 127.0.0.1, and EPSS/KEV data were not supplied.

Unauthenticated exposure of full Kubernetes cluster routing topology and cache-cluster shard addresses in Zalando Skipper's routesrv component (versions prior to 0.27.13) allows any in-cluster pod to retrieve Ingress/RouteGroup configurations, OAuth/OIDC filter chains, backend URLs, and Redis/Valkey shard addresses via plain HTTP GET requests to predictable endpoints. An attacker who has established any pod foothold within the cluster can bypass Kubernetes RBAC entirely - escalating from namespace-scoped access to cluster-wide routing intelligence - enabling targeted follow-on attacks against cache infrastructure and internal backends. No public exploit code is confirmed and this CVE does not appear in the CISA KEV catalog, but the GHSA advisory provides a complete, step-by-step attack path with specific endpoint enumeration that substantially lowers the practical exploitation bar.

Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.

Memory exhaustion denial-of-service in Zalando Skipper's Kubernetes admission webhook handler allows any authenticated in-cluster client to OOM-kill the skipper process by submitting an oversized HTTP request body. The Go handler at `dataclients/kubernetes/admission/admission.go:76` calls `io.ReadAll(r.Body)` with no preceding size guard, enabling unbounded heap allocation from attacker-controlled input (CWE-770). No public exploit has been identified at time of analysis; recovery is automatic via kubelet pod restart, but the disruption window blocks Ingress and RouteGroup admission operations for the cluster.

TLS certificate verification bypass in Kuma's kuma-dp data plane allows an on-path attacker to intercept the dataplane authentication token and inject a forged bootstrap configuration, effectively taking over the proxy. Affected deployments are Universal mode installations where operators start kuma-dp against an HTTPS control plane without supplying a CA certificate via --ca-cert-file or the KUMA_CONTROL_PLANE_CA_CERT environment variable. Standard Kubernetes installations using kumactl or the official Helm chart are not affected because the mutating admission webhook automatically injects the CA certificate. No public exploit or CISA KEV listing is present at time of analysis; patch releases are available across all supported branches.

Unauthenticated path traversal in Nuclio Dashboard's function build API allows arbitrary file write as root inside the Dashboard container. The `spec.handler` field accepts unsanitized module names containing `../` sequences, which Go's `path.Join`/`path.Clean` resolves to escape the build temp directory; the resulting path is passed to `os.WriteFile` running as `uid=0`. Versions up to and including 1.15.27 are affected; a full working proof-of-concept has been publicly disclosed, though no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Build-time remote code execution in Nuclio (serverless/FaaS platform) versions <= 1.15.27 lets remote attackers run arbitrary OS commands as root inside the function-builder container. The Java runtime renders user-supplied runtimeAttributes.repositories values into a Groovy build.gradle file via Go's text/template using the non-escaping {{ . }} action, so an attacker can inject a closing brace to break out of the repositories {} block and append Groovy that Gradle executes during its configuration phase. Because the Dashboard API defaults to NOP (no) authentication, exploitation needs no credentials; a dynamically-verified proof-of-concept is published in the vendor advisory, though there is no public exploit identified as being used in active attacks.

Unhandled Go runtime panic in CoreDNS 1.9.4 through 1.14.4 allows a network-reachable DNS client with AXFR permission to crash the CoreDNS process via a zone transfer request, causing a denial of service against cluster DNS. The crash path is triggered only when the k8s_external plugin is configured for headless-service zone transfers and Kubernetes contains a headless service with no declared ports - a condition that causes an empty record batch to be forwarded to plugin/transfer/transfer.go, where an unchecked index access (records[0]) panics the Go runtime. No public exploit identified at time of analysis; the vendor fix is confirmed in v1.14.5.

Improper authorization in cert-manager 1.18.0 through 1.19.5 and 1.20.0-1.20.2 lets a namespaced tenant with standard Challenge/Order create rights forge ACME Challenge resources that reference a ClusterIssuer, bypassing DNS01 solver selectors (dnsZones, dnsNames, matchLabels) so the controller uses cluster-wide DNS credentials for attacker-chosen provider settings and names. The primary consequence is disclosure of shared ClusterIssuer DNS credentials - notably acme-dns X-Api-User and X-Api-Key headers - enabling cross-tenant credential theft in multi-tenant clusters. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Authentication bypass and control-plane information disclosure in Envoy Gateway (versions >= 1.8.0-rc.0 to < 1.8.1, and all releases < 1.7.4) allows any in-cluster pod that can reach the xDS gRPC server on port 18000 to read sensitive xDS resources without valid credentials. The flaw affects only deployments running in GatewayNamespaceMode, where the JWT StreamInterceptor mishandles State-of-the-World DiscoveryRequests and no UnaryInterceptor guards the Fetch endpoints, exposing TLS private keys (SDS), clusters/endpoints, and routing configuration. No public exploit identified at time of analysis, and it is not listed in CISA KEV; CVSS is 7.4 (High).

Arbitrary file disclosure in Envoy Gateway's controller allows a low-privileged tenant who can create an EnvoyExtensionPolicy to read sensitive files from the gateway controller pod. A path-normalization gap in the security.lua critical-path check (CWE-20) lets attacker-supplied Lua bypass the read restriction using double-slash paths (e.g. //etc/passwd), exposing Kubernetes service-account tokens, TLS certificates, and process environment. No public exploit identified at time of analysis, but the vendor advisory documents the exact bypass and CVSS is rated 9.1.

Envoy Gateway's Wasm extension cache HTTP server (port 18002) can be crashed by a tenant-level attacker, causing a cross-tenant control-plane denial of service. The race condition in httpserver.go causes Go's runtime to call runtime.throw upon detecting an unsynchronized concurrent map access - a fatal signal that net/http's per-connection recover cannot intercept - terminating the entire controller process. While Kubernetes restarts the pod, all tenants sharing the controller lose control-plane availability during the restart window. No public exploit has been identified at time of analysis, but the four-condition precondition set is largely within baseline tenant capabilities.