CVE-2024-58269 is a vulnerability in Rancher Manager that exposes sensitive information through audit logs. Secret data and cluster registration tokens are recorded in cleartext within audit logs, accessible to anyone with log access. This includes Kubernetes secret values embedded in annotations and non-expiring cluster import URLs and tokens. Attackers with log access could recover secrets or use tokens to re-enroll nodes and gain unauthorized cluster access. The issue is fixed in Rancher version 0.0.0-20251013203444-50dc516a19ea. Workarounds include applying audit log redaction policies and restricting log access to trusted users.
NeuVector versions prior to 5.4.7 contain a hard-coded cryptographic key embedded in the binary, used to encrypt sensitive configuration data. This static key approach poses a security risk as the key is fixed and potentially exposed. The issue is resolved in version 5.4.7 and later, where NeuVector uses a dynamically generated encryption key stored securely as a Kubernetes secret, improving key management and security. There is no workaround; users must upgrade to a fixed version.
NeuVector Enforcer contains a critical vulnerability where environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used unsafely to construct shell commands executed via popen without sanitization. This allows command injection and buffer overflow within the enforcer container. The issue is fixed in versions 5.3.5, 5.4.7, and later. No workaround exists; users must upgrade promptly.
Apache Traffic Control contains an Inefficient Regular Expression Complexity vulnerability (CVE-2025-61581) affecting all versions up to 8.0.2. This vulnerability allows users with access to the Traffic Router management interface to specify malicious regex patterns that can cause service unavailability. The project is retired and no fixes will be released. Users are advised to restrict access to trusted users or migrate to alternatives.
CVE-2025-62157 is a vulnerability in Argo Workflows (versions >=3.7.0 <3.7.3 and <3.6.12) where an attacker with permissions to read pod logs in the Argo namespace can access plaintext artifact repository credentials from the workflow-controller logs. This exposure allows unauthorized access to the artifact repository, enabling data theft, tampering, or deletion.
A Zip Slip vulnerability (CVE-2025-62156) exists in Argo Workflows versions prior to 3.6.12 and between 3.7.0 and before 3.7.3. The flaw occurs during artifact extraction where path traversal entries in tar.gz archives allow files to be written outside the intended extraction directory, specifically into system directories like /etc/. This enables attackers to overwrite critical configuration files within container environments. The vulnerability arises from improper path validation in the untar() function, which uses filepath.Join with cleaned but unchecked paths, allowing absolute paths to escape the extraction directory. A proof of concept demonstrates exploitation by uploading a crafted archive and mounting volumes to achieve file creation in /etc/.
A high-severity vulnerability (CVE-2025-61688) in the Omni software allows sensitive information to be leaked via an API. The flaw affects versions prior to 1.1.5 and 1.0.2. No workarounds are available, but patches have been released in versions 1.1.5, 1.0.2, and 1.2.0 to address the issue.
CVE-2025-59836 is a denial of service vulnerability in the Omni Resource Service caused by a nil pointer dereference. Unauthenticated users can trigger a server panic by sending empty create or update resource requests to the API endpoints. The root cause is missing nil checks on the resource's Metadata field before accessing its Version property, leading to a segmentation fault and server crash.
A vulnerability in quic-go allows a misbehaving or malicious server to cause a denial-of-service (DoS) by triggering a client crash. This occurs when the server sends a premature HANDSHAKE_DONE frame during the handshake, violating protocol expectations and causing an assertion failure in the client. The issue affects multiple versions prior to 0.49.1 and between 0.50.0 and 0.54.0 inclusive. Fixed versions include 0.49.1, 0.54.1, and later releases. Users should upgrade to these fixed versions to prevent crashes.
CVE-2025-54286 is a Cross-Site Request Forgery (CSRF) vulnerability in Canonical's LXD when using client certificate authentication with the LXD-UI. The vulnerability arises because client certificates bypass the SameSite cookie protections, and the LXD API accepts JSON payloads even when the Content-Type header is set to text/plain or application/x-www-form-urlencoded, allowing CSRF attacks via HTML form submissions. An attacker can exploit this by tricking an authenticated user into visiting a malicious website that automatically creates and starts arbitrary container instances. The vulnerability requires the victim to be authenticated with client certificates and have permissions to create instances. Fixes are available in LXD versions 5.0.5, 5.21.4, and 6.5.
CVE-2025-54288 is a vulnerability in Canonical LXD's devLXD server where the source container identification relies on process command line information. This allows attackers with root privileges inside a container to spoof process names and impersonate other containers, thereby accessing their metadata, configuration, and device information. The issue arises because the identification function trusts cmdline data without sufficiently verifying PID namespaces. Fixes are available in LXD versions 5.21.4 and 6.5.
A vulnerability in Canonical LXD's operations API allows attackers with read-only permissions to hijack WebSocket connections used for terminal and console sessions. By exploiting secret values exposed in the API, attackers can execute arbitrary commands inside instances with the victim's privileges. The attack requires precise timing and the victim to open a terminal or console session. Fixes are available in LXD versions 5.21.4 and 6.5.
A vulnerability in Canonical LXD's images export API allows unauthenticated attackers to determine the existence of projects by observing different HTTP error responses. Specifically, when querying images with wildcard fingerprints, the API returns a 500 error if multiple images match in an existing project, but a 404 error if the project does not exist. This discrepancy enables project enumeration without authentication. The vulnerability is fixed in LXD versions 5.21.4 and 6.5.
A path traversal vulnerability exists in the validLogFileName function of the LXD 5.0 LTS series, allowing attackers with access to LXD-UI to read arbitrary files on the LXD host by exploiting insufficient validation of log file names. The issue also affects the validExecOutputFileName function, enabling attackers with command execution privileges inside containers to create symbolic links and access host files. This vulnerability was fixed as a side effect in LXD 5.21.4 and later versions. The flaw could lead to disclosure of sensitive host configuration files, LXD database files, and data from other instances.
CVE-2025-54291 is an information disclosure vulnerability in Canonical's LXD API allowing unauthenticated users to determine the existence of projects by observing differing HTTP status codes returned from the /1.0/images endpoint. The API returns a 404 error for non-existent projects and a 403 error for existing projects without viewing permissions. This behavior leaks project existence information but does not expose project resource details. The issue is fixed in LXD versions 5.21.4 and 6.5.
The go-mail library (github.com/wneessen/go-mail) had a vulnerability in versions prior to 0.7.1 where mail addresses passed to the SMTP client were not properly encoded. This improper handling allowed raw mail address values to be sent directly, potentially enabling wrong address routing or SMTP command smuggling. The issue was fixed in version 0.7.1.
Darktrace uncovered a sophisticated cybercrime-as-a-service campaign utilizing Python and Go-based malware, Docker containerization, and a full operator UI. The attack combines DDoS techniques with targeted exploitation, featuring HTTP/2 rapid reset, Cloudflare UAM bypass, and large-scale HTTP floods. The infrastructure resembles a DDoS-as-a-service platform, mirroring legitimate cloud-native applications in design and usability. Initial access is gained through exposed Docker daemons on AWS EC2, with a multi-stage deployment process. The malware uses a Go-based RAT with RESTful communication and includes advanced evasion techniques. The campaign highlights the need for defenders to monitor cloud workloads, container orchestration, and API activity to counter evolving threats.
Yurei, a newly emerged ransomware group, targeted a Sri Lankan food manufacturing company on September 5, 2025. The group employs a double-extortion model, encrypting files and exfiltrating sensitive data. Check Point Research discovered that Yurei's ransomware is based on the open-source Prince-Ransomware, with minor modifications. The ransomware, written in Go, contains a flaw allowing partial recovery through Shadow Copies. Since its first victim, Yurei has quickly expanded to three victims across Sri Lanka, India, and Nigeria. The investigation suggests the threat actor may originate from Morocco. Yurei's operation demonstrates how open-source malware lowers the entry barrier for cybercriminals, enabling less-skilled actors to launch ransomware attacks.
A vulnerability in podman kube play allows overwriting host files when using ConfigMap or Secret volume mounts if a symlink to a host file exists in the volume. An attacker can create a malicious symlink on the volume during the first run, causing subsequent runs to write to arbitrary host files. The attacker controls the target path but not the content, which is defined by the user in the YAML file. This issue is fixed in podman version 5.6.1.
NVIDIA Container Toolkit for all platforms has a vulnerability in the update-ldcache hook that allows an attacker to cause a link following via a specially crafted container image. Exploitation could lead to data tampering and denial of service. The vulnerability is tracked as CVE-2025-23267 and affects multiple versions prior to 1.17.8, 0.17.3, 25.3.2, and 0.12.2. A patch is available to address this issue.
