Tag: kubernetes
-
HashiCorp Consul Vulnerability Allows Attackers to Bypass Authorization and Gain Elevated Privileges
HashiCorp disclosed a vulnerability in consul-k8s, a cross-namespace authorization bypass that could let attackers with limited Kubernetes permissions gain elevated Consul privileges. This vulnerability is tracked as CVE-2026-110720 and affects component access control list (ACL) binding rules when automated system ACL management is enabled. HashiCorp published advisory HCSEC-2026-50 on October 26, 2026, and released fixes…
-
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/meshery-open-source-cloud-native-manager-kubernetes/
-
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/meshery-open-source-cloud-native-manager-kubernetes/
-
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems.The vulnerabilities are listed below – CVE-2026-63688 (CVSS score: 10.0) – A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an First seen…
-
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-max-severity-dell-csm-flaws-give-hackers-admin-privileges/
-
OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths
OperTraitor, an open-source, LLM-powered engine that identifies Kubernetes operators whose RBAC (Role-Based Access Control) privileges exceed their documented operational requirements. Research indicates that over 5% of assessed operators requested excessive permissions, including cluster-wide access to secrets and potential pathways to cluster-admin-level control. Kubernetes operators automate application deployment, configuration, and lifecycle management through Custom Resource Definitions…
-
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
Tags: access, cloud, credentials, cyber, identity, infrastructure, kubernetes, microsoft, software, supply-chain, theftMicrosoft has detailed a cloud-focused intrusion attributed to Storm-3068, in which attackers turned a compromised user account into a launch point for Azure DevOps abuse, Kubernetes credential theft, and potential access to connected cloud environments. The campaign demonstrates how identity compromise can quickly escalate into a software supply-chain and production-infrastructure incident when development platforms have…
-
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
Tags: access, cloud, credentials, cyber, identity, infrastructure, kubernetes, microsoft, software, supply-chain, theftMicrosoft has detailed a cloud-focused intrusion attributed to Storm-3068, in which attackers turned a compromised user account into a launch point for Azure DevOps abuse, Kubernetes credential theft, and potential access to connected cloud environments. The campaign demonstrates how identity compromise can quickly escalate into a software supply-chain and production-infrastructure incident when development platforms have…
-
EU Cyber Resilience Act requirements for containers and Kubernetes
Starting in full force on”¯Dec. 10, 2024, the EU Cyber Resilience Act (CRA)”¯is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/30/rapidfort-cra-container-compliance/
-
EU Cyber Resilience Act requirements for containers and Kubernetes
Starting in full force on”¯Dec. 10, 2024, the EU Cyber Resilience Act (CRA)”¯is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/30/rapidfort-cra-container-compliance/
-
Kubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applications
A post-exploitation technique that lets attackers with root-level access to a Kubernetes node steal workload identities issued through SPIFFE/SPIRE and impersonate legitimate applications running on the same host. The technique undermines the node-trust assumption behind cloud-native machine identity systems, potentially enabling attackers to access services protected by mutual TLS and identity-based authorization. Palo Alto Networks…
-
12 Best Kubernetes Security Tools Compared (2026): Features Pricing
Quick Answer: Kubernetes security quotes hinge on the node-vs-cluster-vs-developer unit choice, and the OSS floor (Kubescape, Falco, Calico, NeuVector, Cilium/Tetragon) resets every negotiation. Sysdig and Aqua lead paid runtime/lifecycle; Cisco (Isovalent) now owns the eBPF network layer; Fairwinds sells governance-as-guardrails; Microsoft Defender publishes the anchor rates. Kubernetes made compute cheap to sprawl and expensive to…
-
Kubernetes 1.37 Is Here: Pod Rightsizing, DRA, and Gang Scheduling
Tags: kubernetesKubernetes 1.37 shipped on August 26, and it’s a good time to check in on a couple of features that kept coming up in roadmap conversations: in-place pod resizing and Dynamic Resource Allocation (DRA). Both of these features have been… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/kubernetes-1-37-is-here-pod-rightsizing-dra-and-gang-scheduling/
-
Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets
A new Shai-Hulud supply-chain attack dubbed Trinitite has compromised the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with more than 150,000 weekly downloads. The malicious releases deploy an evolved Mini Shai-Hulud worm designed to steal developer, cloud, CI/CD, package-registry, Kubernetes, Vault, and source-control credentials before using recovered access to spread through additional packages. While…
-
What Does It Cost to Get Kubernetes Operations Wrong?
<div cla Kubernetes operations carry costs beyond infrastructure spend. The question is whether your organization has the ownership, expertise, and capacity to operate production Kubernetes over time. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/what-does-it-cost-to-get-kubernetes-operations-wrong/
-
CNCF-Projekt erstellt Backups, migriert Cluster und legt Daten im Objektspeicher ab – Velero sichert Kubernetes-Ressourcen und Volumes
First seen on security-insider.de Jump to article: www.security-insider.de/velero-kubernetes-backup-restore-persistent-volumes-a-d1417d84a53c3af9f3f58234487fc742/