Daily Digest
The most urgent database-related issue is a CISA KEV-confirmed vulnerability in MySQL (CVE-2023-21912), which is actively exploited in the wild and requires immediate patching or mitigation.
Summary: A critical vulnerability in MySQL Server allows unauthenticated remote attackers to execute arbitrary code via the MySQL client/server protocol. CISA has confirmed active exploitation, with a remediation deadline of 2023-10-17.
Affected Features / Interoperability: Impacts the MySQL Server component and client/server protocol. Could disrupt database replication, client driver connectivity, and integrations relying on MySQL's network protocol.
Source: https://nvd.nist.gov/vuln/detail/CVE-2023-21912
Actions:
In the cloud security landscape this week, the most urgent finding is CVE‑2026‑4740 affecting Kubernetes, a HIGH‑severity vulnerability with a CVSS score of 8.2; no CISA KEV‑confirmed entries were present, so this highest‑severity issue takes precedence. All other reported issues are lower in severity or lack confirmed exploitation.
Summary: A flaw in Open Cluster Management (OCM) allows a managed‑cluster administrator to forge a client certificate that the OCM controller will approve, enabling cross‑cluster privilege escalation and potential control over other managed clusters, including the hub.
Affected Features / Interoperability: OCM certificate validation mechanism; may break cross‑cluster authentication and management integrations.
Source: https://access.redhat.com/errata/RHSA-2026:11414, https://access.redhat.com/errata/RHSA-2026:13542, https://access.redhat.com/errata/RHSA-2026:13853, https://access.redhat.com/errata/RHSA-2026:8218, https://access.redhat.com/errata/RHSA-2026:9848
Actions:
Summary: In KubeVirt’s safepath package, the OpenAtNoFollow function bypasses O_PATH|O_NOFOLLOW protection when a symlink is involved, allowing a virt‑launcher pod attacker to hijack IPC sockets and inject arbitrary domain events, potentially crashing VM management services or corrupting VM state.
Affected Features / Interoperability: virt‑launcher IPC socket handling, VM lifecycle events, and file‑ownership operations within KubeVirt.
Source: https://access.redhat.com/errata/RHSA-2026:51031, https://access.redhat.com/errata/RHSA-2026:53655, https://access.redhat.com/errata/RHSA-2026:53671, https://access.redhat.com/errata/RHSA-2026:53684, https://access.redhat.com/errata/RHSA-2026:53721
Actions:
Summary: docker‑socket‑proxy fails to properly gate read endpoints in the `/containers` Docker API namespace when the `CONTAINERS` environment variable is set, allowing attackers to retrieve arbitrary files and entire container filesystems via crafted GET requests.
Affected Features / Interoperability: Docker API endpoints for archive, export, logs, and top; may expose sensitive host files and container data.
Source: https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732, https://github.com/Tecnativa/docker-socket-proxy, https://github.com/Tecnativa/docker-socket-proxy/blob/v0.5.0/haproxy.cfg#L49-L61, https://github.com/Tecnativa/docker-socket-proxy/issues/182, https://github.com/Tecnativa/docker-socket-proxy/pull/183
Actions: