Skip to content
Fencer Intel
medium 5.3

CVE-2026-64858 json

vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler

published 4mo ago modified 15h ago also GHSA-6v6c-4cxg-cc93 , EUVD-2026-123765

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository ckotzbauer/vulnerability-operator. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16.

Patch / fix

Is CVE-2026-64858 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

  • ckotzbauer vulnerability-operator

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality
  • CWE-548 Exposure of Information Through Directory Listing

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of ckotzbauer/vulnerability-operator published their own advisory on GitHub. Reviewed sources take precedence over it.