Daily Digest
User Safety: safe
The most urgent issue in cloud security today is CVE-2026-12564 in Kubernetes, a CISA KEV-confirmed critical vulnerability (CVSS 9.6) that allows authenticated attackers with credential-creation privileges to exfiltrate Kubernetes service account tokens via the AAP Controller's HashiCorp Vault credential plugin, enabling full control over cluster namespaces and access to sensitive database credentials and Django SECRET_KEY. This vulnerability is actively exploited in the wild and requires immediate patching.
Summary: The AAP Controller's HashiCorp Vault credential plugin improperly sends Kubernetes service account tokens to attacker-controlled URLs when testing credentials with `kubernetes_role` authentication. An authenticated attacker with credential-creation privileges can exfiltrate tokens and gain full Kubernetes API access.
Affected Features / Interoperability: HashiCorp Vault credential plugin, Kubernetes service account token handling, database credential storage, Django SECRET_KEY exposure.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: A flaw in the governance-policy-addon-controller allows users with annotation permissions on ManagedClusterAddOn resources to override container images, enabling cluster-admin privilege escalation and arbitrary code execution on managed clusters.
Affected Features / Interoperability: Governance policy addon controller, container image management, cluster-admin role permissions.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: The cluster-proxy service appends caller-supplied impersonation group headers to proxied requests without sanitization, allowing hub principals to escalate to cluster-admin on all managed clusters.
Affected Features / Interoperability: Cluster proxy service, impersonation headers, hub-to-spoke cluster communication.
Source: Red Hat Errata RHSA-2026:46885, RHSA-2026:47388, RHSA-2026:47735, RHSA-2026:47949, RHSA-2026:47953
Actions:
Summary: Improper validation of Kubernetes client certificate renewal in Open Cluster Management allows managed cluster administrators to forge certificates, enabling cross-cluster privilege escalation to hub cluster control.
Affected Features / Interoperability: Open Cluster Management (OCM), Kubernetes client certificate renewal, hub-spoke cluster trust model.
Source: Red Hat Errata RHSA-2026:11414, RHSA-2026:13542, RHSA-2026:13853, RHSA-2026:8218, RHSA-2026:9848
Actions:
Summary: The submariner-operator component allows cluster administrators or users modifying Submariner Custom Resources to specify unvalidated image paths, enabling arbitrary code execution with elevated privileges across the cluster.
Affected Features / Interoperability: Submariner operator, Custom Resource definitions, cluster-wide privilege escalation.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: The Submariner Custom Resource stores IPsec pre-shared keys (PSK) in unencrypted format, allowing unauthorized access to keys and passive decryption of inter-cluster traffic.
Affected Features / Interoperability: Submariner IPsec configuration, cross-cluster network encryption, traffic confidentiality.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: A malicious tenant can inject arbitrary code into their feature repository in the Feast operator, which executes with elevated privileges, enabling privilege escalation to cluster-admin.
Affected Features / Interoperability: Feast operator, feature repository execution, tenant isolation.
Source: Red Hat Errata RHSA-2026:53261, RHSA-2026:53262, Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: The must-gather component collects Secret data in cleartext within wrapper Custom Resources, exposing credentials and tokens in archives accessible to anyone with archive access.
Affected Features / Interoperability: must-gather diagnostic tool, Secret data collection, credential exposure.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: The must-gather component dumps cluster Proxy objects in raw form, bypassing oc inspect redaction and exposing proxy basic-auth credentials in archives.
Affected Features / Interoperability: must-gather diagnostic tool, proxy credential collection, authentication exposure.
Source: Red Hat Security Advisory, Red Hat Bugzilla
Actions:
Summary: The `sh` Python library performs incomplete privilege drops when using the `_uid` option, allowing child processes to retain supplementary group access (e.g., docker, root) even after UID change.
Affected Features / Interoperability: Python process launching, privilege management, group access control.
Source: GitHub Commit, GitHub Pull Request, GitHub Release, GitHub Security Advisory
Actions:
Summary: The WhatsApp MCP Server exposes an unauthenticated HTTP API on 127.0.0.1:8080 without Host header validation, allowing local processes (or remote via DNS rebinding) to read arbitrary files and send messages via the WhatsApp bridge.
Affected Features / Interoperability: HTTP API, file system access, WhatsApp messaging, DNS rebinding attack surface.
Source: GitHub SECURITY.md, GitHub Release, GitHub Security Advisory
Actions:
Summary: Malcolm's upload-processing pipeline fails to apply compression limits to single-stream compressed formats (.gz, .bz2, etc.), enabling authenticated users to upload gzip bombs that exhaust shared Docker volumes.
Affected Features / Interoperability: Upload processing pipeline, libarchive extraction, disk space management, OpenSearch/Logstash/Zeek integration.
Source: GitHub Advisory, CISA ICSA-26-230-01, GitHub Advisory
Actions:
Summary: UpTrain's `/create_project` endpoint is vulnerable to remote code execution via `checks` and `metadata` parameters, allowing authenticated users to execute arbitrary code in the host container context.
Affected Features / Interoperability: UpTrain project creation endpoint, code execution, container isolation.
Source: GitHub Source Code, GitHub Security Lab Advisory
Actions:
Summary: Docker Sandboxes (sbx) applies read-only intent to in-guest container binds while allowing write access to the underlying virtio-fs host grant, enabling unprivileged sandbox code to write to host directories.
Affected Features / Interoperability: Docker AI Sandboxes, virtio-fs host-edge grants, container-to-host file access.
Source: Docker Documentation, Docker Architecture Docs
Actions:
Summary: The `mise` tool fails to normalize ownership when extracting release archives, allowing local users with UID/GID 1001 to replace root-installed executables in shared paths like /usr/local/bin.
Affected Features / Interoperability: mise package manager, executable installation, privilege escalation.
Source: GitHub Commit, GitHub Pull Request, GitHub Release
Actions: