#Kubernetes
All CosmicBytez Labs articles tagged #Kubernetes, across news, security advisories, how-to guides, and projects.
- HOWTO
Container Image Signing and Verification with Cosign and Sigstore
Sign your container images with Cosign's keyless Sigstore workflow, verify signatures before deploy, and enforce the policy in Kubernetes so unsigned images never run.
- Security
CVE-2026-54472: Hard-Coded Credentials in Dell CSM Docs Component Expose Sensitive Data
A hard-coded credential in Dell Container Storage Modules' csm-docs component lets unauthenticated attackers read sensitive data.
- Security
CVE-2026-61421: Hard-Coded JWT Signing Key in Dell CSM Authorization Enables Admin Token Forgery
A hard-coded JWT signing key in Dell CSM Authorization lets unauthenticated attackers forge admin tokens and seize control.
- Security
CVE-2026-63688: Missing Authentication in Dell CSM Authorization gRPC Server Exposes Storage Array Credentials
An unauthenticated gRPC server in Dell CSM Authorization lets attackers retrieve admin credentials for every registered storage array.
- Security
CVE-2026-63692: Dell CSM Authorization Proxy Missing Authentication Allows Cross-Tenant Admin Takeover
A missing authentication flaw in Dell CSM's authorization proxy lets unauthenticated attackers gain admin privileges across tenants.
- Security
CVE-2026-67269: Dell CSM Operator Flaw Lets Low-Privileged Users Escalate to Cluster Node Root
A Dell Container Storage Modules Operator flaw lets low-privileged Kubernetes users escalate to root via a crafted Custom Resource.
- News
Dell Asks Admins to Patch Max-Severity CSM Flaws as Soon as Possible
Dell fixed six critical CSM flaws, two with a perfect CVSS 10.0, letting unauthenticated attackers seize admin control of Kubernetes storage arrays.
- News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs, letting attackers steal storage admin credentials and gain root on Kubernetes nodes.
- Security
Contrast Initializer Leaks Workload Secret to stdout (CVE-2025-71423)
A regression in Edgeless Systems Contrast logs the full NewMeshCert response, including the workload secret, to stdout at INFO level.
- Security
Contrast Initializer Leaks Workload Secret to stderr (CVE-2025-71425)
Edgeless Systems Contrast before 1.8.1 logs the workload secret to stderr at the default log level, exposing it via Kubernetes logs.
- Security
Contrast Coordinator Recovery Seed Verification Bypass (CVE-2025-71426)
A recovering Contrast Coordinator fails to verify the supplied seed, letting an attacker stand up a rogue Coordinator to impersonate a workload owner.
- Security
CVE-2026-54523: Kyverno CEL Generator Bypasses Namespace Isolation
Critical Kyverno flaw lets a namespace-scoped policy invoke generator.apply() with an arbitrary namespace, creating RoleBindings in kube-system.
- Security
CVE-2026-78155: Critical Privilege Escalation in StackGres Kubernetes Operator
A CVSS 9.9 flaw in the StackGres Kubernetes operator lets a low-privilege tenant escalate to full cluster admin rights.
- Security
CVE-2026-67567: Critical Privilege Escalation in Multicloud Operators Subscription
A CVSS 9.9 flaw in multicloud-operators-subscription lets tenants bypass security controls via malicious HelmRelease CRs, enabling privileged Helm execution.
- Security
CVE-2026-71566: KubeVirt Auth Bypass via FakeFish Credential Ignore
CVSS 9.3 critical: KubeVirt's FakeFish BMC emulator ignores provided credentials, letting any user claim admin access.
- Security
CVE-2026-14450: MaaS API Auth Bypass via Forged HTTP Headers
A critical CVSS 9.9 flaw in the MaaS API allows any pod within a Kubernetes cluster to bypass the Kuadrant AuthPolicy gateway by forging X-MaaS-Username...
- Security
CVE-2026-50540: Kata Containers Host Code Execution via Unvalidated Config Path
A critical vulnerability in Kata Containers prior to 4.0.0 allows a pod user to load an arbitrary TOML file on the host through an unvalidated annotation,...
- Security
CVE-2026-10059: Multicluster Engine ClusterCurator Token Escalation (CVSS 9.1)
A critical privilege escalation vulnerability in Red Hat's Multicluster Engine for Kubernetes allows a tenant administrator to exploit the ClusterCurator...
- Security
CVE-2026-10090: Red Hat ACM Helm Channel Privilege Escalation (CVSS 9.9)
A critical privilege escalation flaw in Red Hat Advanced Cluster Management for Kubernetes allows a namespace-scoped user to hijack cluster-admin...
- Security
CVE-2026-56163: Critical Auth Bypass in Azure Kubernetes Service Allows Privilege Escalation
A CVSS 10.0 vulnerability in Microsoft Azure Kubernetes Service allows unauthenticated attackers to escalate privileges over the network due to missing...
- Security
CVE-2026-7374: KubeVirt virt-handler Symlink RCE (CVSS 9.9)
A critical symlink validation flaw in KubeVirt's virt-handler lets authenticated OpenShift users with edit access in a single namespace escalate to arbitrary.
- Security
CVE-2026-42457: vCluster Platform Stored XSS via templateRef Name Field
A stored cross-site scripting vulnerability in vCluster Platform allows attackers to inject and execute arbitrary JavaScript via the name field of a...
- Security
CVE-2026-42296: Argo Workflows templateReferencing Strict
A high-severity security bypass in Argo Workflows (CVSS 8.1) allows users with Workflow creation permissions to escape templateReferencing: Strict mode,...
- Security
CVE-2026-43824: Argo CD ServerSideDiff Exposes Cleartext
A high-severity vulnerability in Argo CD's ServerSideDiff feature allows authenticated users to read Kubernetes Secret data in cleartext, affecting...
- HOWTO
Container Security Scanning with Trivy: Images, IaC, and CI/CD
Learn how to use Trivy to scan container images, Dockerfiles, Kubernetes manifests, and Terraform for vulnerabilities and misconfigurations — then...
- News
Trivy Hack Spreads Infostealer via Docker, Triggers Worm
The Trivy supply chain attack has expanded dramatically beyond GitHub Actions: malicious Docker Hub images (versions 0.69.4–0.69.6) carry an infostealer,...
- Security
CVE-2025-69902: Critical Command Injection in kubectl-mcp-server
A critical command injection vulnerability in kubectl-mcp-server allows unauthenticated attackers to execute arbitrary OS commands through unsanitized...
- HOWTO
How to Deploy Falco for Kubernetes Runtime Security
Step-by-step guide to deploying Falco as a Kubernetes runtime security engine. Covers Helm installation, custom rule authoring, Falcosidekick alerting...
- News
VoidLink: AI-Generated Cloud-Native Malware Framework
Researchers uncover VoidLink, an 88,000-line Zig-based malware framework built with AI assistance that targets AWS, Azure, GCP, and Kubernetes environments.
- HOWTO
Kubernetes Network Policies: Microsegmentation Guide
Implement network microsegmentation in Kubernetes with Network Policies. Covers default deny, allow rules, namespace isolation, egress policies, and debugging.
- HOWTO
Kubernetes Secrets Management with External Secrets Operator
Securely manage Kubernetes secrets using External Secrets Operator. Covers ESO installation, SecretStore configuration, syncing from Azure Key Vault and...
- Project
Kubernetes Homelab Cluster with K3s
Build a production-grade K3s cluster on Proxmox/bare metal with Longhorn storage, Traefik ingress, cert-manager, and ArgoCD for GitOps.
- Newsletter
Welcome to CosmicBytez Labs - Issue #1
Welcome to the first issue of the CosmicBytez Labs newsletter! This week: major security vulnerabilities, Kubernetes best practices, and cloud...
- HOWTO
Docker Security Fundamentals: Protecting Your Containers
Learn essential Docker security practices including image scanning, runtime protection, network isolation, and secrets management for production environments.