General Security News (unfiltered)
Scoped Vulnerability Tracking
The most urgent item is CVE-2026-74891 in PostgreSQL, a CRITICAL-severity vulnerability involving hardcoded database credentials in standalone server configuration files, which allows network-based attackers to access databases using well-known default credentials.
Summary: Hardcoded database credentials in standalone server configuration files allow attackers on the same network to access PostgreSQL databases using well-known default credentials to retrieve sensitive data.
Affected Features / Interoperability: Standalone server configuration files; potential impact on database authentication mechanisms and client connections relying on these configurations.
Source:
Actions:
Summary: The DataRow.Decode function fails to properly validate field lengths, allowing a malicious or compromised PostgreSQL server to send a DataRow message with a negative field length, causing a slice bounds out of range panic.
Affected Features / Interoperability: DataRow message decoding in PostgreSQL client libraries; potential impact on client applications using affected versions of the library for data retrieval operations.
Source:
Actions:
Summary: In the Distribution toolkit, prior to version 3.1.0, when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, the delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, allowing a later Stat or Get from another repo to repopulate the shared descriptor and make the deleted blob readable from the original repo again.
Affected Features / Interoperability: Blob descriptor caching and deletion mechanisms in container content distribution systems; potential impact on access control and data integrity in multi-repository environments.
Source:
Actions:
Summary: A use-after-free vulnerability in the Linux kernel's ublk driver can cause system crashes or hangs during device recovery operations, particularly when the ublk server fails to start user recovery properly.
Affected Features / Interoperability: ublk device driver in the Linux kernel; potential impact on block device operations and system stability during recovery scenarios.
Source:
Actions:
Summary: A use-after-free vulnerability in the Linux kernel's ath9k Wi-Fi driver can cause system crashes when the firmware load fails during device disconnection, due to dereferencing a freed device structure.
Affected Features / Interoperability: ath9k Wi-Fi driver in the Linux kernel; potential impact on wireless network connectivity and system stability.
Source:
Actions:
PostgreSQL:
Microsoft SQL Server:
The most urgent item is CVE-2026-42880 in Argo CD (Kubernetes GitOps tool), a CRITICAL-severity flaw (CVSS 9.6) that allows read-only attackers to extract plaintext Kubernetes Secrets from etcd via the ServerSideDiff endpoint. This vulnerability is actively exploited in the wild per CISA KEV and impacts any Kubernetes cluster using Argo CD for GitOps deployments, potentially exposing sensitive credentials across all managed clusters.
Summary: A missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism. This issue affects Argo CD versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9.
Affected Features / Interoperability: Impacts Argo CD's ServerSideDiff endpoint, which is used for comparing configuration differences during GitOps deployments. Downstream functionality affected includes Kubernetes Secret management, etcd data access, and GitOps deployment pipelines. Any integration relying on Argo CD for declarative cluster management is at risk.
Source:
Actions:
Summary: A flaw in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values.
Affected Features / Interoperability: Impacts RHACM and MCE service-proxy components, affecting cluster management and multi-cluster orchestration. Downstream functionality includes managed cluster administration, hub-to-spoke communication, and RBAC enforcement across clusters.
Source:
Actions:
Summary: Improper validation of Kubernetes client certificate renewal in Open Cluster Management (OCM) allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller, enabling cross-cluster privilege escalation and potential control over other managed clusters including the hub cluster.
Affected Features / Interoperability: Impacts OCM's client certificate management and approval workflows, affecting cluster registration, certificate rotation, and inter-cluster trust relationships. Downstream functionality includes managed cluster onboarding and hub cluster security boundaries.
Source:
Actions:
Summary: Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API, allowing an authenticated user with a valid API token to send deeply nested queries causing excessive resource consumption and denial of service for the management plane.
Affected Features / Interoperability: Impacts RHACS Central's GraphQL API endpoint, affecting security monitoring and management plane availability. Downstream functionality includes vulnerability scanning, compliance reporting, and security policy enforcement.
Source:
Actions:
Summary: A flaw in KubeVirt's safepath package used by virt-handler allows an attacker with access to a virt-launcher pod to redirect virt-handler's IPC socket connections via symlink following, enabling injection of arbitrary domain events that can corrupt VM state or crash VM management services.
Affected Features / Interoperability: Impacts KubeVirt's virt-handler and virt-launcher components, affecting virtual machine lifecycle management and IPC communication. Downstream functionality includes VM creation, migration, and state management across Kubernetes nodes.
Source:
Actions:
Summary: A race condition in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network through concurrent execution using shared resources with improper synchronization.
Affected Features / Interoperability: Impacts Azure Attestation and Device Health Attestation services, affecting device identity verification and attestation workflows. Downstream functionality includes Azure AD device registration, conditional access policies, and IoT device management.
Source:
Actions:
Summary: An integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network.
Affected Features / Interoperability: Impacts Azure Attestation and Device Health Attestation services, affecting device identity verification and attestation workflows. Downstream functionality includes Azure AD device registration, conditional access policies, and IoT device management.
Source:
Actions:
Summary: The OpenShift build process configures the docker-build container with a hostPath volume mount mapping the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials for pulling images from private repositories, and the mount is not read-only, allowing attackers to overwrite it and cause denial of service or exfiltrate secrets.
Affected Features / Interoperability: Impacts OpenShift build processes using docker-build containers, affecting image pull operations and build pipeline security. Downstream functionality includes CI/CD pipelines, private registry access, and node-level image management.
Source:
Actions:
Summary: When a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries from the container's filesystem rather than the host's, allowing a malicious container image with trojanized decompression binaries to achieve arbitrary code execution with full daemon privileges.
Affected Features / Interoperability: Impacts Docker daemon's archive upload and copy operations, affecting container file transfer mechanisms. Downstream functionality includes container deployment, file synchronization, and image management workflows.
Source:
Actions:
Summary: A security vulnerability in Moby allows plugins privilege validation to be bypassed during docker plugin install due to an error in the daemon's privilege comparison logic, potentially accepting a privilege set that differs from the one approved by the user.
Affected Features / Interoperability: Impacts Docker plugin installation and privilege validation workflows, affecting plugin security and access control. Downstream functionality includes third-party plugin integration and container extension management.
Source:
Actions:
Summary: A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version 6.3.85, and no customer action is needed.
Affected Features / Interoperability: Impacts Google Cloud Google SecOps (Chronicle SOAR) legacy dashboard widget API, affecting security orchestration and incident response workflows. Downstream functionality includes SOAR platform integrations and security automation pipelines.
Source:
Actions:
Microsoft Azure:
AWS: