Daily Digest
User Safety: safe
The most urgent item in today's digest is CVE-2026-66384, a path-traversal flaw in JFrog Artifactory's Docker cache logic that is on the CISA KEV catalog with a remediation due date of 2026-09-10 — meaning confirmed in-the-wild exploitation, not theoretical risk. A self-hosted Artifactory instance reachable from any user with valid credentials could allow Docker cache writes to escape the intended directory under specific remote-repo conditions, and any healthcare environment using Artifactory for container image governance (supply-chain controls, signed-image promotion) should treat this as a same-week remediation. The remaining entries are a mix of GCP-side secrets exposure, Kubernetes multi-cluster networking flaws, and Coolify host-level RCE, each requiring action but without the confirmed-exploitation urgency of the KEV item.
Summary: JFrog Artifactory has a path-traversal / improper-pathname-limitation flaw (CWE-22 family) in its Docker cache handling. An authenticated user can write data outside the intended Docker cache path when certain remote-repository conditions are met. CISA added this to the KEV on 2026-08-27 with a remediation due date of 2026-09-10, and ransomware use is listed as "Unknown" (i.e., not confirmed but not ruled out). Exploitation requires valid Artifactory credentials; it is not unauthenticated.
Affected Features / Interoperability: Specifically the Docker cache path under certain remote-repository configurations. Downstream impact: any container that Artifactory has resolved, cached, or proxied to a remote Docker registry could be affected, and writes outside the cache path could corrupt or poison other Artifactory-managed artifacts, metadata, or filesystem locations that other services and CI pipelines read from. The raw data does not specify the exact JFrog fix version, only that vendor mitigations must be applied per CISA BOD 26-04.
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-66384
Actions:
Summary: Coolify versions before 4.2.0 fail to properly escape environment variable key names when constructing Docker commands that are executed over SSH on managed servers. An authenticated attacker can inject shell metacharacters into env-var keys to execute arbitrary commands on the host running the managed server — i.e., breakout from a container context to the host. This is a high-impact, authenticated-RCE on the management plane.
Affected Features / Interoperability: The Coolify SSH-based Docker management path (env-var key handling) and any servers/swarms Coolify is orchestrating. Downstream impact: any container, volume, image, or secret that Coolify manages on a registered server could be tampered with, and the host itself is compromised.
Source: https://github.com/coollabsio/coolify, https://github.com/coollabsio/coolify/releases/tag/v4.2.0, https://github.com/coollabsio/coolify/commit/b50839d4515b115b7ded5db609471440249995da
Actions:
Summary: A vulnerability in GitLab's AI Gateway component (affecting 18.10–19.0.12, 19.1–19.1.7, 19.2–19.2.2) allowed an authenticated user with Duo Agent Platform access to craft an inline flow that overrides the HTTP Host header on outbound model requests, redirecting them to an attacker-controlled endpoint. The flaw disclosed Google Cloud Vertex (GCP Vertex AI) service credentials and private signing keys to that endpoint. Requires authentication and Duo Agent Platform access; network-exploitable once that access is held.
Affected Features / Interoperability: GitLab Duo Agent Platform's AI Gateway integration with Google Cloud Vertex. Downstream impact: any GCP Vertex workload or pipeline that used Vertex credentials callable from the AI Gateway could be impersonated; the leaked signing keys could allow forged responses/tokens. Homelab users running self-hosted GitLab with Duo → Vertex need the same upgrade as enterprise users.
Source: https://gitlab.com/gitlab-org/gitlab/-/work_items/616990, https://hackerone.com/reports/3945100
Actions:
Summary: The Submariner operator stores the IPsec pre-shared key (PSK) used to secure inter-cluster network traffic in unencrypted form within the Submariner Custom Resource (CR). Anyone able to read the CR can passively decrypt traffic between any two clusters in the Submariner mesh, leading to broad cross-cluster data disclosure.
Affected Features / Interoperability: Submariner's IPsec PSK storage in its CR, which underpins all encrypted cross-cluster pod/service connectivity in a Submariner mesh. Downstream impact: any service replicated or federated across clusters via Submariner (e.g., databases, API gateways, PKI components) could have its in-transit data decrypted by anyone with CR-read access.
Source: https://access.redhat.com/errata/RHSA-2026:60386, https://access.redhat.com/errata/RHSA-2026:60387, https://access.redhat.com/errata/RHSA-2026:60388, https://access.redhat.com/errata/RHSA-2026:60389, https://access.redhat.com/errata/RHSA-2026:60390
Actions:
Summary: Red Hat Advanced Cluster Management for Kubernetes (RHACM) lighthouse component insufficiently validates advertised IP addresses inside EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-chosen IPs, causing the hub lighthouse DNS to redirect legitimate cross-cluster service traffic to malicious endpoints — a transparent MITM on inter-cluster service communication.
Affected Features / Interoperability: RHACM lighthouse DNS and EndpointSlice consumption for cross-cluster service discovery. Downstream impact: any service resolved via RHACM's multi-cluster service DNS (including databases and API services) could be transparently proxied through attacker infrastructure.
Source: https://access.redhat.com/security/cve/CVE-2026-66787, https://bugzilla.redhat.com/show_bug.cgi?id=2507532
Actions:
Summary: Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) allows an actor with limited Kubernetes permissions in a single namespace to cause attacker-controlled certificate material to be inserted into the Elasticsearch client trust bundle managed by ECK in a different namespace — a cross-namespace metadata-spoofing / trust-store poisoning.
Affected Features / Interoperability: ECK's cross-namespace trust bundle for Elasticsearch clients. Downstream impact: any Elasticsearch client (including those in your homelab PKI/data path) that trusts this bundle could be tricked into trusting a malicious CA, enabling MITM against Elasticsearch traffic.
Source: https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105
Actions:
Summary: A flaw in the `submariner-operator` component of RHACM allows a cluster admin — or any user able to modify the Submariner CR — to specify an unvalidated container image path. Deploying that CR pulls and runs an arbitrary image, yielding RCE with elevated privileges across the entire cluster, including control-plane nodes.
Affected Features / Interoperability: Submariner CR image-path handling in RHACM, which has control-plane reach. Downstream impact: a single malicious CR edit can lead to full cluster compromise, including any data services and Vault/PKI components running in that cluster.
Source: https://access.redhat.com/security/cve/CVE-2026-66783, https://bugzilla.redhat.com/show_bug.cgi?id=2507528
Actions:
Summary: Incomplete Cleanup (CWE-459) in ECK causes authentication credentials to persist after a cross-namespace association has been denied by RBAC, allowing a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster.
Affected Features / Interoperability: ECK's cross-namespace Elasticsearch association cleanup. Downstream impact: unauthorized read access to Elasticsearch data in an associated cluster — relevant if homelab or enterprise ES clusters hold any sensitive indexed data.
Source: https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106
Actions:
Unverified chatter — not formal advisories.
AWS:
Microsoft Azure:
Docker: