Daily Digest
User Safety: safe
The most urgent issue is CVE-2025-55190 in Kubernetes (Argo CD), a CISA KEV-confirmed critical vulnerability (CVSS 9.9) allowing unauthorized access to sensitive repository credentials via project-level API tokens, actively exploited in the wild with a due date for remediation. Additional critical vulnerabilities in Docker-based systems (Vasion Print) and high-severity flaws in Kubernetes components (Typebot SSRF, Observability Operator privilege escalation) require immediate attention to prevent credential theft, lateral movement, and infrastructure compromise.
Summary: Server-side request forgery (SSRF) in Microsoft Copilot for Azure enables authorized attackers to disclose information over the network. Exploitation requires network access and authorization within the Azure environment.
Affected Features / Interoperability: Azure Copilot's SSRF protection mechanisms. Downstream integrations relying on Copilot's data access may be compromised.
Source: Microsoft Security Update Guide
Actions:
Summary: Argo CD versions 2.13.0–2.13.8, 2.14.0–2.14.15, 3.0.0–3.0.12, and 3.1.0-rc1–3.1.1 allow project-level API tokens to retrieve sensitive repository credentials. Exploitation requires network access and a valid project-level token.
Affected Features / Interoperability: Argo CD's project-level permissions and API endpoints. Compromised tokens enable unauthorized access to Git repositories and secrets.
Source: Argo CD Security Advisory
Actions:
Summary: Typebot versions prior to 3.13.1 allow authenticated users to exploit SSRF via webhooks, enabling access to AWS IMDS and extraction of EKS node role credentials. Exploitation requires network access and valid credentials.
Affected Features / Interoperability: Typebot's webhook HTTP Request component and AWS IAM integration. Cluster-wide compromise possible via stolen credentials.
Source: Typebot Security Advisory
Actions:
Summary: Observability Operator creates ClusterRole-bound ServiceAccounts, enabling namespace-level users to escalate privileges via MonitorStack CRs. Exploitation requires namespace-level access.
Affected Features / Interoperability: Kubernetes ClusterRole bindings and Red Hat OpenShift monitoring integrations.
Source: Red Hat Security Advisory
Actions:
Summary: Lighthouse component in Red Hat Advanced Cluster Management fails to validate EndpointSlice IPs, enabling MITM attacks across clusters. Exploitation requires control over a spoke cluster.
Affected Features / Interoperability: Cross-cluster DNS resolution and service mesh communications.
Source: Red Hat Security Advisory
Actions:
Summary: KubeVirt versions prior to 1.6.1/1.7.0 allow arbitrary file read/write via hostDisk feature due to logic flaws. Exploitation requires VM access and host file ownership manipulation.
Affected Features / Interoperability: KubeVirt's hostDisk functionality and VM-to-host file system interactions.
Source: KubeVirt Security Advisory
Actions:
Summary: RHACS Central SAML endpoint lacks replay protection, allowing attackers to reuse valid SAML responses for multiple authentication tokens. Exploitation requires intercepted SAML responses.
Affected Features / Interoperability: SAML-based authentication in Red Hat Advanced Cluster Security.
Source: Red Hat Security Advisory
Actions:
Summary: Repeated API calls to BIG-IP Next CNF/SPK cause TMM termination. Exploitation requires network access to the API.
Affected Features / Interoperability: F5 BIG-IP Next traffic management services.
Source: F5 Support Article
Actions:
Summary: Submariner stores IPsec pre-shared keys unencrypted in Custom Resources, enabling passive decryption of inter-cluster traffic. Exploitation requires access to Submariner CRs.
Affected Features / Interoperability: Submariner's IPsec key management and cross-cluster networking.
Source: Red Hat Security Advisory
Actions:
Summary: Submariner Operator allows unvalidated image paths in Custom Resources, enabling arbitrary code execution with elevated privileges. Exploitation requires modification rights to Submariner CRs.
Affected Features / Interoperability: Submariner Operator's image deployment workflows.
Source: Red Hat Security Advisory
Actions:
Summary: Datadog Agent versions 7.65.0–7.70.2 set insecure permissions on Python cache directories, enabling local privilege escalation. Exploitation requires local access and low-privilege account.
Affected Features / Interoperability: Datadog Linux Host Agent's installation process.
Source: Datadog Security Advisory
Actions:
Summary: Vasion Print containers include outdated EOL components (e.g., Nginx 1.17.x, OpenSSL 1.1.1d), enabling exploitation chains. Exploitation requires network access to containers.
Affected Features / Interoperability: Vasion Print's Docker container images and third-party dependencies.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print containers run primary processes as root, increasing breach impact. Exploitation requires container compromise.
Affected Features / Interoperability: Vasion Print's container process execution model.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print contains unauthenticated PHP dead code (e.g., `resetroot.php`) enabling RCE. Exploitation requires access to the `/var/www/app/resetroot.php` endpoint.
Affected Features / Interoperability: Vasion Print's PHP application logic and database access.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print mounts secrets under `/var/www/efs_storage` with permissive permissions, enabling credential theft. Exploitation requires container access.
Affected Features / Interoperability: Vasion Print's secret management and filesystem permissions.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print's SSH client disables host key verification and forwards agent keys, enabling lateral movement. Exploitation requires container compromise.
Affected Features / Interoperability: Vasion Print's SSH client configuration and key management.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print exposes unauthenticated firmware upload with embedded GPG keys, enabling RCE. Exploitation requires access to the `/va-api/v1/update` endpoint.
Affected Features / Interoperability: Vasion Print's firmware update mechanism and GPG key storage.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print exposes internal Docker containers via unauthenticated `/meta` endpoint, enabling service enumeration and API interaction. Exploitation requires network access.
Affected Features / Interoperability: Vasion Print's Docker gateway and internal service mesh.
Source: Vasion Print Security Bulletins
Actions:
Summary: Vasion Print exposes Docker bridge network without authentication, enabling unauthenticated API access. Exploitation requires network access.
Affected Features / Interoperability: Vasion Print's Docker network configuration and firewall rules.
Source: Vasion Print Security Bulletins
Actions:
Summary: IBM Security Verify Access Docker versions 10.0.0.0–10.0.9.0 and 11.0.0.0–11.0.1.0 allow local users to escalate to root. Exploitation requires local access.
Affected Features / Interoperability: IBM Security Verify Access's container privilege model.
Source: IBM Security Advisory
Actions:
Summary: Vasion Print exposes unauthenticated admin routes for certificate management, enabling TLS/SSL manipulation. Exploitation requires network access to the appliance.
Affected Features / Interoperability: Vasion Print's certificate management APIs and TLS configuration.
Source: Vasion Print Security Bulletins
Actions:
Summary: Coder versions 2.22.0–2.24.3 and 2.25.0–2.25.1 fail to expire prebuild session tokens, enabling token reuse. Exploitation requires access to workspace templates.
Affected Features / Interoperability: Coder's session token management and Terraform workspace provisioning.
Source: Coder Security Advisories
Actions:
Summary: Coder versions 2.30.0–2.34.7 allow provisioner daemons to download other organizations' Terraform modules. Exploitation requires org-scoped provisioner keys.
Affected Features / Interoperability: Coder's gRPC DownloadFile handler and Terraform module caching.
Source: Coder Security Advisory
Actions: