Fission versions prior to 1.24.0 contain a critical vulnerability in the Container Executor path that allows a tenant with only functions.fission.io/create permission to escalate privileges and escape the node. This occurs because the Function.spec.podspec field was not properly validated, allowing malicious pod specifications that mount the host root filesystem and share host namespaces. The executor merges these unsafe podspecs into deployments running with high privileges, enabling node escape. The issue is fixed in version 1.24.0 by adding strict validation and sanitization of podspec fields that could lead to privilege escalation or host access.
A vulnerability in Fission's Environment CRD allows attackers with create/update RBAC on environments.fission.io to inject unsafe PodSpec fields, leading to node escape and full cluster takeover. The issue arises from insufficient validation of podSpec fields, a webhook that only validates on create but not update, and unsafe merging of podSpec fields into generated pods. Exploitation enables scheduling privileged pods with host root mounts, exposing the cluster CA private key and allowing signing of arbitrary kubelet certificates. The flaw is fixed in Fission v1.24.0 by adding validation, extending webhook coverage to updates, and sanitizing dangerous podSpec fields during merge.
A vulnerability in Fission's Function admission webhook allows a tenant with permission to create Functions to specify an environment namespace different from their own. This bypasses namespace trust boundaries, enabling the attacker's function to run inside another tenant's container image. This can lead to code and credential theft or confused-deputy attacks. The issue is fixed in version 1.24.0 by validating that the environment namespace matches the function's namespace during admission and controller operations.
A vulnerability in Fission prior to version 1.24.0 allows a function author in one namespace to read the deployment archive, including source code and embedded secrets, of any Package in any other namespace. This occurs because the admission webhook did not validate the PackageRef.Namespace field, allowing cross-namespace Package references. The issue is fixed in version 1.24.0 by enforcing namespace validation in the admission webhook.
A vulnerability in Fission's KubernetesWatchTrigger (KWT) allowed a low-privilege developer to create triggers in their own namespace that could watch events across all namespaces, enabling persistent cross-namespace surveillance. The issue arose from improper validation of the spec.namespace field and insufficient webhook validation on update operations. This allowed attackers to receive full event payloads for Pods, Services, and Jobs cluster-wide without additional privileges. The vulnerability was fixed in version 1.24.0 by enforcing namespace validation and extending webhook checks.
Fission's buildermgr controller failed to verify that the Package Custom Resource Definition (CRD) environment namespace matched the package's own namespace. This allowed an attacker with package creation rights in their own namespace to specify a different namespace for the environment, causing the controller to execute build commands in another tenant's namespace. Malicious build steps could exfiltrate the victim namespace's fission-builder service account token via build logs, enabling read access to all Secrets and ConfigMaps in that namespace. The issue was fixed in Fission v1.24.0 by enforcing namespace checks both at admission webhook and controller levels.
The Fission MessageQueueTrigger (MQT) scaler controller in versions prior to 1.24.0 allowed privilege escalation by exposing two critical flaws. First, it copied plaintext Secret values into Deployment environment variables, enabling users with MQT creation rights but without Secret read permissions to exfiltrate Secrets. Second, it allowed arbitrary user PodSpec injection without restrictions, permitting attackers to run containers with arbitrary images and service accounts, effectively escalating to deployment creation privileges. These issues were fixed in version 1.24.0 by changing Secret handling to use SecretKeyRef references and introducing a strict allowlist for PodSpec fields.
Kahi versions up to and including v0.1.0-alpha.8 have three privilege and permission issues related to improper privilege dropping and socket permissions. These issues allow processes to run with higher privileges than intended and expose FastCGI unix sockets to unauthorized local users. The issues are fixed in version v0.1.0-alpha.9, which enforces fail-closed privilege handling and restricts socket permissions by default.
Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) user through POST /api/n9e/datasource/list. The route is registered without an admin authorization gate, unlike the sibling datasource mutation routes, and the open-source DatasourceFilter does not redact secret fields, so the secret-bearing settings, http, and auth objects are serialized in the response. The disclosed credentials enable access to the connected downstream systems.
fzf versions prior to 0.73.1 are vulnerable to a denial of service (DoS) attack due to inefficient HTTP request body processing in --listen mode. The vulnerability arises from repeated string concatenation causing quadratic time complexity, allowing a crafted POST request with many small segments to monopolize CPU resources and block other clients. This issue was fixed in version 0.73.1.
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.
When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).
A vulnerability in Fleet versions up to 4.84.1 allows an authenticated user with Observer-level privileges to extract sensitive enrollment secrets and Apple Push Notification Service tokens via an unvalidated order_key parameter in the Apple MDM commands endpoint. This flaw enables a sort-order oracle attack that leaks sensitive data character-by-character without exposing it directly in responses. The issue is fixed in version 4.84.2.
Fleet versions prior to 4.85.0 have a vulnerability in the global policy read endpoint that allows authenticated users with observer-level access on any team to read policy details from other teams. This occurs because the endpoint does not verify team ownership and returns policy data without proper scope checks. The flaw allows enumeration of policy IDs to access sensitive policy SQL queries and related metadata across team boundaries. The issue is fixed in version 4.85.0.
A vulnerability in Pterodactyl Wings allows changing file permissions outside the server container by exploiting symlinks. The function responsible for changing file permissions does not prevent following symlinks, enabling modification of host files' permissions. This affects versions from 1.11.9 up to but not including 1.12.2.
The turso-cli tool stores the user's Turso platform JWT token in a settings.json file with default file permissions set to 0o644, making the file world-readable on Linux and macOS systems. This allows any local user on the same host to read the token and gain full access to the Turso platform scoped to the user's organizations. The token grants capabilities such as creating or destroying databases, rotating credentials, exfiltrating data, and changing billing settings. The issue arises because the Viper library used for configuration defaults to 0o644 permissions and turso-cli does not override this. A patch is available that sets the file permissions to 0o600, restricting access to the owner only.
A vulnerability in the Hysteria project allows an attacker to send excessively large HTTP headers without proper termination, causing the server to consume excessive memory and potentially crash. This occurs because the HTTP header sniffing implementation does not enforce an upper limit on header size, leading to denial of service (DoS) via resource exhaustion. The issue affects versions prior to 2.9.2.
An authenticated client can crash the Hysteria server by advertising a very small QUIC max_datagram_frame_size and triggering a UDP response. The server's fragmentation code does not handle cases where the UDP message header size exceeds the maximum datagram payload size, causing a slice bounds panic and server termination. This vulnerability affects Hysteria versions prior to 2.9.2.
Hysteria's UDP relay implementation contains an authenticated UDP ACL bypass vulnerability. The server applies ACL and outbound policy only once per UDP session at session creation, but later packets within the same session can specify different destinations without re-evaluating ACL rules. This allows an authenticated client to send UDP packets to localhost or private network addresses that should be blocked by ACL, potentially exposing internal UDP services. The issue affects versions from 2.0.0 up to but not including 2.9.2. No patch or official fix is currently documented.
CVE-2026-48769 is a critical arbitrary file write vulnerability in the Incus client prior to version 7.2.0. It arises when the client trusts a malicious image server's crafted 'Incus-Image-Hash' header containing path traversal sequences, allowing an attacker to write files outside the intended directory. This can lead to arbitrary command execution as root on the server. The vulnerability is due to the client creating and writing to a file named after the unvalidated hash before verifying its integrity. A proof-of-concept demonstrates exploitation by writing a cron job file to achieve remote code execution.
A nil-pointer dereference vulnerability exists in the Incus daemon's CreateCustomVolumeFromBackup function, triggered when processing a custom volume backup with a volume snapshot missing the expires_at field. An authenticated user with permission to create storage volumes can cause the incusd daemon to crash by uploading a crafted backup tarball. This results in a denial of service due to the daemon process terminating unexpectedly.