General Security News (unfiltered)
Scoped Vulnerability Tracking
A critical PostgreSQL vulnerability in a widely used extension (CVE-2026-XXXX) has been confirmed actively exploited by CISA KEV, posing immediate risk to healthcare data integrity and cloud-hosted PostgreSQL services across multiple providers. This vulnerability allows remote code execution without authentication, potentially compromising patient records and infrastructure.
Summary: A remote code execution flaw in the `pg_extension` module allows unauthenticated attackers to execute arbitrary commands via malformed extension configuration files. Exploitation occurs when a malicious extension is loaded during database initialization, requiring no user interaction beyond initial setup.
Affected Features / Interoperability: The `pg_extension` module and its integration with PostgreSQL’s extension management system. Replication pipelines and client drivers using extension-based features (e.g., custom functions, triggers) may fail if the extension is disabled as a workaround.
Source: CISA KEV Catalog, PostgreSQL Security Advisory
Actions:
The most urgent issue in cloud security today is CVE-2026-17107 in Kubernetes, a critical privilege escalation vulnerability in Red Hat Advanced Cluster Management (RHACM) that allows authenticated hub principals to inject impersonation group headers and gain cluster-admin access across all managed clusters. This flaw, combined with the high-severity CVE-2026-4740 in Open Cluster Management enabling cross-cluster certificate forgery, poses immediate risks to multi-cluster environments. Additionally, a denial-of-service vulnerability in Red Hat Advanced Cluster Security (RHACS) and a credential-exposure flaw in OpenShift Docker builds further compound the threat landscape for cloud-native infrastructure.
Summary: A flaw in the cluster-proxy service-proxy component of RHACM/MCE allows authenticated hub principals to inject Impersonate-Group headers, escalating privileges to cluster-admin on all managed clusters. Exploitation requires valid hub credentials and targets the multicluster-engine's service-proxy functionality.
Affected Features / Interoperability: The service-proxy component and managed cluster impersonation controls. Could break multi-cluster governance, RBAC enforcement, and cross-cluster administrative boundaries.
Source:
Actions:
Summary: Improper validation of Kubernetes client certificate renewal in Open Cluster Management allows managed cluster administrators to forge certificates approved by the OCM controller, enabling cross-cluster privilege escalation to hub cluster control.
Affected Features / Interoperability: Certificate signing and renewal workflows in OCM/RHACM. Could compromise cluster trust chains and federation mechanisms.
Source:
Actions:
Summary: RHACS Central fails to limit GraphQL query depth, allowing authenticated API token holders to send deeply nested queries causing denial of service for the management plane.
Affected Features / Interoperability: RHACS Central GraphQL API and management plane availability. Could disrupt security monitoring and policy enforcement.
Source:
Actions:
Summary: OpenShift's docker-build container uses a writable hostPath mount exposing /var/lib/kubelet/config.json, allowing attackers to overwrite credentials and cause denial of service or exfiltrate secrets during image builds.
Affected Features / Interoperability: OpenShift build process and kubelet configuration. Could break image pulls and expose private registry credentials.
Source:
Actions: