https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:06:08.048026+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-02146 bdu:2024-02146 2026-10-03T20:06:08.109701+00:00 bdu:2024-02146 https://cve.radiocsirt.org/vuln/euvd-2026-230783 EUVD-2026-230783 2026-10-03T20:06:08.109766+00:00 EUVD-2026-230783 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28110 fkie_cve-2024-28110 2026-10-03T20:06:08.109787+00:00

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.

 https://cve.radiocsirt.org/vuln/ghsa-5pf6-2qwx-pxm2 GHSA-5pf6-2qwx-pxm2 — Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials 2026-10-03T20:06:08.109834+00:00

Affected: Go: github.com/cloudevents/sdk-go/v2

### Impact _What kind of vulnerability is it? Who is impacted?_ Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints.

The relevant code is [here](https://github.com/cloudevents/sdk-go/blob/67e389964131d55d65cd14b4eb32d57a47312695/v2/protocol/http/protocol.go#L104-L110) (also inline, emphasis added):

<pre>if p.Client == nil { p.Client = **http.DefaultClient** }

if p.roundTripper != nil { p.Client.**Transport = p.roundTripper** } </pre>

When the transport is populated with an authenticated transport such as: - [oauth2.Transport](https://pkg.go.dev/golang.org/x/oauth2#Transport) - [idtoken.NewClient(...).Transport](https://pkg.go.dev/google.golang.org/api/idtoken#NewClient)

... then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to **any endpoint** it is used to contact!

Found and patched by: @tcnghia and @mattmoor

### Patches v.2.15.2

 https://cve.radiocsirt.org/vuln/gsd-2024-28110 gsd-2024-28110 2026-10-03T20:06:08.109892+00:00 gsd-2024-28110 https://cve.radiocsirt.org/vuln/msrc_cve-2024-28110 msrc_CVE-2024-28110 — Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials 2026-10-03T20:06:08.109911+00:00 msrc_CVE-2024-28110 https://cve.radiocsirt.org/vuln/rhea-2024:4022 RHEA-2024:4022 — Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release 2026-10-03T20:06:08.109936+00:00

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials jose-go: improper handling of highly compressed data cosign: Malicious attachments can cause system-wide denial of service cosign: Malicious artifects can cause machine-wide denial of service

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0637 WID-SEC-W-2024-0637 — Red Hat OpenShift Serverless: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-03T20:06:08.109969+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Serverless ausnutzen, um Informationen offenzulegen.