A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.

A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.

nodejs-yargs-parser: prototype pollution vulnerability nodejs-y18n: prototype pollution vulnerability kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 jwt-go: access restriction bypass vulnerability nodejs-date-and-time: ReDoS in parsing via date.compile golang: math/big: panic during recursive division of very large numbers golang: crypto/elliptic: incorrect operations on the P-224 curve NooBaa: noobaa-operator leaking RPC AuthToken into log files