The most urgent issue is CVE‑2026‑105312, a CRITICAL (CVSS 9.9) Kubernetes vulnerability that enables a tenant with console‑create rights to gain cross‑tenant Strimzi control‑plane access – a CISA KEV‑confirmed exploit that must be patched immediately. Other high‑severity findings, such as the Argo CD JSONNet and Kustomize flaws (also CVSS 9.9) and the Docker Langchain‑Chatchat RCE (CVSS 9.8), are serious but are not currently known to be actively exploited via CISA KEV.
Formal Vulnerabilities
Google Cloud Platform
CVE-2026-85267 (CVSS UNSCORED UNSCORED)
Summary: Cloud Shell prior to 22 July 2026 is vulnerable to a cross‑site WebSocket hijacking that lets an unauthenticated attacker hijack an active session and exfiltrate the user’s OAuth access token. No authentication or network restrictions are required; the attack is possible from any network location.
Affected Features / Interoperability: Compromise of the Cloud Shell session can be leveraged to steal OAuth tokens used by downstream Google Cloud services, potentially affecting any applications that rely on Cloud Shell for CLI access.
Fix: Patched on 22 July 2026; no customer action required.
Workaround: Not needed – the vulnerability is already resolved.
Tradeoff: No significant tradeoff.
Kubernetes
CVE-2026-105312 (CVSS 9.9 CRITICAL)
Summary: A Kubernetes tenant with create permission on Console custom resources can set `spec.containers.api.spec.image` to an arbitrary container image. The operator runs this image in a pod with a ServiceAccount bound to a ClusterRole that grants cluster‑wide read/write access to Strimzi CRDs, Kafka resources, and monitoring APIs, allowing the attacker to read and modify Strimzi control‑plane resources.
Affected Features / Interoperability: Strimzi Kafka operator and any other operators that consume Strimzi CRDs, cross‑tenant control‑plane access, potentially leading to unauthorized changes in Kafka clusters and monitoring configurations.
Fix: Upgrade to Argo CD (or the underlying Kubernetes operator) versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0‑rc2, which remove the unrestricted image setting.
Workaround: Restrict Console custom‑resource creation to namespaces where the operator’s ServiceAccount has limited RBAC, or remove cluster‑wide Secrets read permission from the operator’s ServiceAccount.
Tradeoff: Limiting Console CR creation may impede legitimate multi‑tenant operations; removing cluster‑wide Secrets access could affect other workloads that rely on those permissions.
CVE-2026-113672 (CVSS 9.9 CRITICAL)
Summary: Argo CD’s repo‑server parses `.jsonnet` files without restricting import paths, allowing absolute paths, parent‑directory traversal, and symlink resolution to read any file on the repo‑server (including tokens, private keys, and environment variables) or cause memory exhaustion via `importstr` on `/dev/zero`. An attacker with only `get` permission on an Application can upload a malicious `.jsonnet` file.
Affected Features / Interoperability: Argo CD repo‑server, GitOps pipelines that import `.jsonnet` files, any application that uses the importer functionality.
Fix: Upgrade Argo CD to versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0‑rc2, which confine imports to the repository root.
Workaround: Disable the built‑in importer (`--disable-built-in-tools`) or run the repo‑server with a read‑only filesystem and restrict the Application’s `get` permission to specific directories.
Tradeoff: Disabling the importer may break legitimate use of `.jsonnet` files; read‑only filesystem restrictions can impede legitimate file accesses.
CVE-2026-113708 (CVSS 9.9 CRITICAL)
Summary: In Argo CD, a leading‑hyphen in a remote resource URL (e.g., `file://-`) is parsed as `--upload-pack` by Kustomize, causing arbitrary command execution inside the `argocd-repo-server` process when the transport is `file://`. The command runs as the repo‑server user, exposing credentials and other process‑accessible data.
Affected Features / Interoperability: Argo CD repo‑server, Kustomize integration, GitOps pipelines that use Kustomize with remote resource URLs containing leading hyphens.
Fix: Upgrade to Argo CD versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0‑rc2, which require an end‑of‑options separator in remote URLs.
Workaround: Avoid using `file://` transports with leading hyphens, or ensure remote URLs include a space before any options.
Tradeoff: Restricting URL formats may limit legitimate Kustomize usage; the fix requires upgrading the server component.
CVE-2026-113709 (CVSS 9.9 CRITICAL)
Summary: When `--enable-helm` is enabled, Argo CD allows `helmGlobals.configHome` to be set via a Kustomization, causing Helm to load a plugin from a repository‑controlled location and execute it inside `argocd-repo-server`. This runs as the repo‑server user and can read credentials and other sensitive data.
Affected Features / Interoperability: Argo CD repo‑server, Helm chart rendering, Kustomize‑Helm integration.
Fix: Upgrade to Argo CD versions 3.3.15, 3.4.10, 3.5.4, or 3.6.0‑rc2, which restrict `configHome` usage.
Workaround: Disable the `--enable-helm` flag, or ensure `configHome` points to a trusted, non‑repository location, and run the repo‑server with limited filesystem permissions.
Tradeoff: Disabling Helm support limits Helm chart deployments; limiting `configHome` may affect legitimate Helm operations.
CVE-2026-105311 (CVSS 7.7 HIGH)
Summary: The StreamsHub Console operator acts as a confused deputy: a tenant can set `spec.kafkaClusters[].credentials.kafkaUser.namespace` to any namespace, causing the operator to read the victim‑namespace KafkaUser secret (containing SASL credentials or TLS keys) and write the plaintext into a secret in the attacker’s namespace.
Affected Features / Interoperability: StreamsHub Console operator, Kafka user secret leakage across namespaces, potential credential exposure for other services.
Fix: Patch the operator to enforce same‑namespace checks or an allowlist, and upgrade to a version that resolves the confused‑deputy behavior.
Workaround: Restrict Console custom‑resource creation to the same namespace as the Kafka cluster, or remove cluster‑wide Secrets RBAC from the operator’s ServiceAccount.
Tradeoff: Limiting namespace scope may hinder legitimate cross‑namespace operations; removing cluster‑wide Secrets access could affect other components that depend on those permissions.
CVE-2026-113727 (CVSS 7.4 HIGH)
Summary: OpenChoreo’s PUT `/workflowruns/{runName}` endpoint allows an authenticated caller to rewrite a victim run’s ownership labels by specifying project/component labels in the request body while selecting the run via the URL path, leading to unauthorized read of logs, deletion, spec modifications, or permanent failed state.
Affected Features / Interoperability: OpenChoreo workflow runs, cross‑project/cross‑component access within the same namespace, affecting audit logs, spec validation, and run lifecycle states.
Fix: Upgrade to OpenChoreo versions 1.0.6, 1.1.7, or 1.2.5, which enforce proper label validation and namespace checks.
Workaround: Enforce stricter label validation policies or disable the update endpoint for users lacking `workflowrun:update` on the target project/component.
Tradeoff: Stricter validation may reduce flexibility for legitimate label updates; disabling the endpoint limits functionality for authorized users.
Docker
CVE-2026-75128 (CVSS 9.8 CRITICAL)
Summary: Langchain‑Chatchat exposes a `POST /tools/call` endpoint that invokes any registered tool (including the shell tool) without authentication, allowing remote attackers to execute arbitrary OS commands as root in the Docker container.
Affected Features / Interoperability: Langchain‑Chatchat Docker image, any tool registration that includes the shell tool, potentially affecting any application that calls the `/tools/call` API.
Fix: Upgrade to Langchain‑Chatchat version 0.3.1.4 or later, which adds authentication to the `tools/call` endpoint.
Workaround: Remove or disable the shell tool registration, or protect the endpoint behind authentication (e.g., API key or OAuth).
Tradeoff: Disabling the shell tool may break legitimate automation; adding authentication introduces operational overhead.
CVE-2026-114087 (CVSS 8.1 HIGH)
Summary: Trigger.dev self‑hosted Docker Compose deployments use a hardcoded `MAGIC_LINK_SECRET` in `hosting/docker/.env.example`, allowing anyone to forge valid magic‑link tokens and log in as any user, then access Postgres, Redis, and ClickHouse with default credentials, compromising tenant data.
Affected Features / Interoperability: Trigger.dev deployment, tenant data stored in Postgres, Redis, and ClickHouse, potentially leading to data leakage or manipulation.
Fix: Upgrade to Trigger.dev version 4.5.6 or later, which removes the hardcoded secret and requires explicit token generation.
Workaround: Rotate the `MAGIC_LINK_SECRET` manually and redeploy, or enforce network segmentation to limit access to the internal services.
Tradeoff: Manual secret rotation may cause downtime; network segmentation can limit legitimate access to internal services.
CVE-2026-109441 (CVSS 5.8 MEDIUM)
Summary: LangAlpha places all tenant sandboxes on Docker’s shared default bridge network with inter‑container communication enabled, allowing a compromised sandbox to directly connect to other tenants’ containers and read files such as vault secrets.
Affected Features / Interoperability: LangAlpha sandbox containers, cross‑tenant data exposure, potential leakage of vault secrets and other sensitive files.
Fix: Upgrade to LangAlpha version after 2026‑09‑07, which isolates sandboxes using a dedicated Docker network.
Workaround: Disable inter‑container communication by configuring each sandbox with a custom bridge network or using Docker’s `network_mode: none`.
Tradeoff: Custom networking may complicate legitimate cross‑container communication required by some workloads.
CVE-2026-86009 (CVSS UNSCORED UNSCORED)
Summary: Mailu domain managers can enable spoofing for hosted domains they do not control, allowing them to send DKIM‑ and SPF‑authenticated emails for domains they shouldn't, leading to email impersonation.
Affected Features / Interoperability: Mailu domain management, email authentication (DKIM/SPF), potentially enabling phishing or spoofed communications.