CVE-2026-64858

CVSS 5.3 (medium) · published 2026-11-11

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

Weakness: CWE-306, CWE-548

Source: NVD CVE-2026-64858

References

• https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae
• https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16
• https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93
• https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.