Security Digest — 2026-09-10

Scoped Vulnerability Tracking

User Safety: safe

Cloud Security

Cloud security remains under intense pressure as the most urgent threat is CVE‑2026‑54745, a CISA‑KEV‑confirmed critical SSRF vulnerability in Kubeflow Pipelines that allows any unauthenticated attacker to reach internal services and exfiltrate credentials. While other high‑severity issues exist across Kubernetes, Docker, and Terraform components, this KEV‑validated flaw demands immediate patching and mitigation across all cloud‑native workloads.

Formal Vulnerabilities

Kubernetes — CVE-2026-54745 (CVSS 10.0 CRITICAL)

Summary: Kubeflow Pipelines exposes an unauthenticated SSRF vulnerability in the /_proxy/ route, allowing any unauthenticated client to forward requests to internal services and potentially retrieve cloud metadata credentials or modify cluster resources.

Affected Features / Interoperability: The Kubeflow Pipelines frontend and the /_proxy/ route are impacted; downstream effects include unauthorized access to internal APIs, credential leakage, and potential cluster compromise.

Source: https://github.com/kubeflow/pipelines/commit/a35f97aa4c17b25572369e5022546ab4421bdbdd, https://github.com/kubeflow/pipelines/pull/13511, https://github.com/kubeflow/pipelines/releases/tag/2.17.0, https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7, https://github.com/kubeflow/pipelines/security/advisories/GHSA-gqww-5pj5-8fq7

Actions:

• Fix: upgrade to version 2.17.0
• Workaround: none; immediate upgrade required
• Tradeoff: no significant tradeoff

Kubernetes — CVE-2026-73263 (CVSS 9.9 CRITICAL)

Summary: Prowler's Kubernetes provider connection test accepts a malicious kubeconfig containing a legacy GCP auth‑provider command, which triggers subprocess execution on the worker and leads to arbitrary command execution.

Affected Features / Interoperability: The Kubernetes provider connection test in Prowler is affected; downstream impact includes potential code execution on the worker and compromise of the Prowler service.

Source: https://github.com/prowler-cloud/prowler/commit/0b782fcb8c24ece7bd38deede2b8f13d8583e39c, https://github.com/prowler-cloud/prowler/pull/12091, https://github.com/prowler-cloud/prowler/releases/tag/5.36.0, https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j, https://github.com/prowler-cloud/prowler/security/advisories/GHSA-ccqh-6cjc-wp4j

Actions:

• Fix: upgrade to version 5.36.0
• Workaround: none; upgrade required
• Tradeoff: no significant tradeoff

Kubernetes — CVE-2026-88877 (CVSS 9.8 CRITICAL)

Summary: Traefik's Kubernetes ingress‑nginx provider mishandles Ingresses that contain both an authentication annotation and the from‑to‑www‑redirect annotation, creating a sibling router that bypasses authentication and all annotation‑derived middlewares.

Affected Features / Interoperability: The ingress‑nginx provider and Ingress resources with both annotations are impacted; downstream effects include loss of authentication, IP allowlisting, and other middleware protections.

Source: https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29, https://www.vulncheck.com/advisories/traefik-3.7.0-authentication-bypass-via-from-to-www-redirect

Actions:

• Fix: upgrade to version 3.7.12
• Workaround: none; upgrade required
• Tradeoff: no significant tradeoff

Kubernetes — CVE-2026-49478 (CVSS 8.7 HIGH)

Summary: Fulcio, the OIDC certificate authority, improperly follows cross‑host redirects and injects Kubernetes ServiceAccount tokens during discovery, enabling SSRF and token leakage to external hosts.

Affected Features / Interoperability: Fulcio OIDC discovery and token injection are affected; downstream impact includes potential SSRF attacks and exposure of ServiceAccount tokens.

Source: https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1, https://github.com/sigstore/fulcio/pull/2354, https://github.com/sigstore/fulcio/releases/tag/v1.8.6, https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6

Actions:

• Fix: upgrade to version 1.8.6
• Workaround: none; upgrade required
• Tradeoff: no significant tradeoff

Kubernetes — CVE-2026-55848 (CVSS 8.6 HIGH)

Summary: MapFish Print accepts an attacker‑controlled GML layer URL and fetches XML without disabling external entities, allowing unauthenticated attackers to read local files such as Kubernetes service‑account tokens and certificates via SSRF.

Affected Features / Interoperability: The /api/print3/print endpoint and GML layer handling in MapFish Print are affected; downstream impact includes disclosure of sensitive files and possible SSRF.

Source: https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec, https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121, https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb, https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d, https://github.com/mapfish/mapfish-print